BaselineCompiler: Assertion failure: index >= size_t(pcstack.depth()), at jsopcode.cpp:1514

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:t][jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on baseline compiler branch revision b7e4d01b541e (run with --ion-eager):


Object = function () {};
var p = Proxy.create({});
Object.prototype.__proto__ = p;
function newFunc(x) { new Function(x)(); };
newFunc('\
function f(v, value) {\
    "failed: " + v + " " + value\
}\
f({}, false);\
f(Object.prototype, false);\
');
(Assignee)

Comment 1

5 years ago
Created attachment 717874 [details] [diff] [review]
Patch

The decompiler strikes again, string + object can throw so we have to ensure these values are on the stack.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #717874 - Flags: review?(kvijayan)

Updated

5 years ago
Attachment #717874 - Flags: review?(kvijayan) → review+
Whiteboard: [jsbugmon:update] → [js:t][jsbugmon:update]
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/d363079a1beb
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.