ALIASEDVAR Patch: Assertion failure: op == JSOP_LOCALINC || op == JSOP_INCLOCAL || op == JSOP_LOCALDEC || op == JSOP_DECLOCAL || op == JSOP_ARGINC || op == JSOP_INCARG || op == JSOP_ARGDEC || op == JSOP_DECARG, at methodjit/InvokeHelpers.cpp:729

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

unspecified
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
The following test asserts on mozilla-central revision 7ed31daf07bd with patch from bug 740259 (options -m -n -a):


function testMethodInit() {
    function o() {}
    function k() {
        for (i = 0; i < this.depth; ++i) {}
    }
    for (var i = 0; i < 10; i++)
        (i) = {o: o, k: k};
}
testMethodInit();
(Assignee)

Updated

5 years ago
Duplicate of this bug: 740442
(Assignee)

Comment 2

5 years ago
Decomposing JSOP_ALIASEDVARINC et al (as is done with PROPINC and ELEMINC) fixed this and 740442.  Rolling the fix and tests back into bug 740259.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 740259
Fixed by patch in bug 740259 -> FIXED
Resolution: DUPLICATE → FIXED
(Reporter)

Comment 4

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug740445.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.