Closed
Bug 596817
Opened 14 years ago
Closed 14 years ago
JM: "Assertion failure: regstate[fe->type.reg()].fe() == fe,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
| Tracking | Status | |
|---|---|---|
| blocking2.0 | --- | beta7+ |
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
(function(){for(var[x]=x>>x in[[]<[]]){[]}})()
asserts js debug shell on TM changeset a409054e1395 with -m at Assertion failure: regstate[reg].fe,
|
Reporter | |
Updated•14 years ago
|
blocking2.0: --- → ?
|
||
Comment 1•14 years ago
|
||
The first bad revision is:
changeset: 53581:5a9241e86ecc
user: Sean Stangl <sstangl@mozilla.com>
date: Mon Sep 13 16:47:57 2010 -0400
summary: Fix isNotType() usage in jsop_rhs_unknown_any(). b=593554, r=dvander.
(This is the first bad revision for both 32-bit and 64-bit.)
|
|
||
Updated•14 years ago
|
Blocks: JaegerFuzz
|
||
Comment 2•14 years ago
|
||
The rsh logic did not handle the haveSameBacking(lhs, rhs) case. Additionally, I realized that a similar bug is present in storeTo(), so it is fixed here.
Attachment #477837 -
Flags: review?(dvander)
|
||
Updated•14 years ago
|
blocking2.0: ? → beta7+
|
|
||
Updated•14 years ago
|
Attachment #477837 -
Flags: review?(dvander) → review+
|
|
Reporter | |
Comment 3•14 years ago
|
||
Now asserts at Assertion failure: regstate[fe->type.reg()].fe() == fe, in TM changeset 491044fa498a
|
|
Reporter | |
Updated•14 years ago
|
Summary: JM: "Assertion failure: regstate[reg].fe," → JM: "Assertion failure: regstate[fe->type.reg()].fe() == fe,"
|
|
||
Comment 4•14 years ago
|
||
checked in?
Comment on attachment 477837 [details] [diff] [review]
Fix rsh, storeTo() bugs involving allocReg().
Gary says this still asserts, marking patch so it doesn't get checked in.
Attachment #477837 -
Flags: review+ → review-
Whoops - might have jumped the gun here. Gary, were you testing with this patch, or just saying that the assertion is different now?
|
|
||
Comment 8•14 years ago
|
||
(In reply to comment #6)
> Whoops - might have jumped the gun here. Gary, were you testing with this
> patch, or just saying that the assertion is different now?
He meant that the assertion changed. The patch fixes the problem, and with it there is no assertion.
Comment on attachment 477837 [details] [diff] [review]
Fix rsh, storeTo() bugs involving allocReg().
Okay, sorry about that
Attachment #477837 -
Flags: review- → review+
|
|
||
Comment 10•14 years ago
|
||
Whiteboard: fixed-in-tracemonkey
|
|
Reporter | |
Comment 11•14 years ago
|
||
(In reply to comment #8)
> (In reply to comment #6)
> > Whoops - might have jumped the gun here. Gary, were you testing with this
> > patch, or just saying that the assertion is different now?
>
> He meant that the assertion changed.
Yup, that's what I meant. ;-)
|
|
||
Comment 12•14 years ago
|
||
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Comment 13•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•