850955 - BaselineCompiler: "Assertion failure: false (Unexpected recompile check!),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

a = []
function f() {
    return a[0]
}
function g() {
    return f()()
}
a.push(([function() {
    ([f(), g()])
}])[0])
g()

asserts js debug shell on ionmonkey changeset f0f398255b65 without any CLI arguments at Assertion failure: false (Unexpected recompile check!),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   124891:f0f398255b65
tag:         tip
user:        Jan de Mooij
date:        Wed Mar 13 23:06:43 2013 +0100
summary:     Bug 848849 - Reset script use count when type information changes. r=bhackett

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fixed likely by backout of bug 848849 here:

http://hg.mozilla.org/projects/ionmonkey/rev/a34329707345