Closed
Bug 621487
Opened 14 years ago
Closed 14 years ago
TypeInference & TM + JM: Assertion failure: fe->data.synced()
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: alexander.miller, Unassigned)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-jaegermonkey)
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Build Identifier:
Assertion failure: fe->data.synced(), at c:/jaegermonkey/js/src/methodjit/FrameState.cpp:804
When running (function() { while (0) { var a, a = b; } })() with -j -m on the jaegermonkey repo, changeset a6438d91ca4d.
Reproducible: Always
Steps to Reproduce:
1. Load (function() { while (0) { var a, a = b; } })()
|
||
Updated•14 years ago
|
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Windows 7 → All
|
||
Updated•14 years ago
|
Blocks: infer-regress
|
|
||
Comment 1•14 years ago
|
||
The first bad revision is:
changeset: 25d5598cbad9
user: Brian Hackett
date: Mon Dec 06 11:53:53 2010 -0800
summary: [INFER] Allocate registers across branches and joins, bug 609899.
Blocks: 609899
|
|
||
Comment 2•14 years ago
|
||
(This happens *without* --enable-type-inference.)
|
||
Comment 3•14 years ago
|
||
This is a bogus assertion, the current state of the frame is irrelevant if synced is set during FrameState::prepareForJump.
http://hg.mozilla.org/projects/jaegermonkey/rev/ef84d90968c9
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
|
||
Comment 4•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug621487.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•