BaselineCompiler: Assertion failure: index >= size_t(pcstack.depth()), at jsopcode.cpp:1514

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on baseline compiler branch revision 1c8552cc6ec4 (run with ):


var protoArr = Proxy.create({
    getOwnPropertyDescriptor: function(name) {
        return (-  0);
    },
    getPropertyDescriptor: function(name) {
        return this.getOwnPropertyDescriptor(name);
    },
}, null);
void (Array.prototype.__proto__ = protoArr);
var status = '';
var statusitems = [];
statusitems[0] = status;
(Assignee)

Comment 1

5 years ago
Created attachment 715990 [details] [diff] [review]
Patch

SETELEM has to ensure the operands are on the stack for the decompiler. SETELEM is more annoying than the other ops, because we have 3 Values and have to keep the RHS on the stack.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #715990 - Flags: review?(kvijayan)

Updated

5 years ago
Attachment #715990 - Flags: review?(kvijayan) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/97f7f7873ba4
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.