Closed Bug 846072 Opened 10 years ago Closed 10 years ago

BaselineCompiler: Assertion failure: index >= size_t(pcstack.depth()), at jsopcode.cpp:1511

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: jandem)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase asserts on baseline compiler branch revision a261716e1b62 (run with --ion-eager):


toString = undefined;
if (!(this in ParallelArray)) {}
Attached patch PatchSplinter Review
I looked at JSOP_IN a while ago and thought it couldn't end up in the decompiler, but as the testcase demonstrates it's possible.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #719408 - Flags: review?(kvijayan)
Attachment #719408 - Flags: review?(kvijayan) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/ade501a84662
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.