Last Comment Bug 740445 - ALIASEDVAR Patch: Assertion failure: op == JSOP_LOCALINC || op == JSOP_INCLOCAL || op == JSOP_LOCALDEC || op == JSOP_DECLOCAL || op == JSOP_ARGINC || op == JSOP_INCARG || op == JSOP_ARGDEC || op == JSOP_DECARG, at methodjit/InvokeHelpers.cpp:729
: ALIASEDVAR Patch: Assertion failure: op == JSOP_LOCALINC || op == JSOP_INCLOC...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: Luke Wagner [:luke]
:
Mentors:
Depends on:
Blocks: langfuzz 740259
  Show dependency treegraph
 
Reported: 2012-03-29 09:58 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:28 PST (History)
2 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2012-03-29 09:58:24 PDT
The following test asserts on mozilla-central revision 7ed31daf07bd with patch from bug 740259 (options -m -n -a):


function testMethodInit() {
    function o() {}
    function k() {
        for (i = 0; i < this.depth; ++i) {}
    }
    for (var i = 0; i < 10; i++)
        (i) = {o: o, k: k};
}
testMethodInit();
Comment 1 Luke Wagner [:luke] 2012-03-29 16:23:10 PDT
*** Bug 740442 has been marked as a duplicate of this bug. ***
Comment 2 Luke Wagner [:luke] 2012-03-29 18:52:40 PDT
Decomposing JSOP_ALIASEDVARINC et al (as is done with PROPINC and ELEMINC) fixed this and 740442.  Rolling the fix and tests back into bug 740259.

*** This bug has been marked as a duplicate of bug 740259 ***
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-04-09 14:35:15 PDT
Fixed by patch in bug 740259 -> FIXED
Comment 4 Christian Holler (:decoder) 2013-01-14 08:28:28 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug740445.js.

Note You need to log in before you can comment on or make changes to this bug.