Closed
Bug 743099
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 or Crash [@ js::ion::VirtualRegister::getInterval]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,reconfirm,ignore])
Crash Data
Attachments
(1 file)
1.55 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision a9a18824b4c1 (run with --ion -n -m --ion-eager): function Day( t ) {} function WeekDay( t ) { var weekday = (Day(t)+4) % 7; return( weekday < 0 ? 7 + weekday : weekday ); } var expect = 'No Error'; for (var i = 0; i < 2; i++) { var [] = expect ? WeekDay( i.a ) : isXMLName.anonymous(i), uneval; }
Comment 1•12 years ago
|
||
The first bad revision is: changeset: 5108b08c2d54 user: Sean Stangl date: Wed Mar 21 17:25:43 2012 -0700 summary: Bug 723333 - Handle JSOP_NEW without callVM(). r=dvander
Reporter | ||
Updated•12 years ago
|
Crash Signature: [@ js::ion::VirtualRegister::getInterval]
Summary: IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 → IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 or Crash [@ js::ion::VirtualRegister::getInterval]
Reporter | ||
Comment 2•12 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision de015aff650d).
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,reconfirm]
Reporter | ||
Comment 3•12 years ago
|
||
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision bc1833f2111e).
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
Comment 4•12 years ago
|
||
The logic for preserving MPhis of |this| is just wrong -- it arbitrarily preserves the final |this| MPhi, but since it makes that decision too late, the dependencies of that MPhi may have already been removed. The fix is just to add the |this| MPhi to the observable set.
Attachment #620481 -
Flags: review?(dvander)
Updated•12 years ago
|
Attachment #620481 -
Flags: review?(dvander) → review+
Comment 5•12 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/525b3eba3bcb
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 6•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug743099.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•