Closed
Bug 669575
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: isRegister(), at IonLIR.h:725
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: adrake, Assigned: dvander)
References
(Blocks 1 open bug)
Details
Attachments
(4 files)
Asserts on attached test case on IonMonkey tip, 32-bit.
Comment 2•12 years ago
|
||
The attached reduced test case reproduces the assertion tripped in Comment 0. Manipulating this test case in obvious ways causes that failure point to oscillate between the original assertion and the new Assertion failure: !freeRegs_.has(to.reg()), at /home/sstangl/dev/ionmonkey/js/src/ion/shared/MoveEmitter-x86-shared.cpp:288
Updated•12 years ago
|
![]() |
Assignee | |
Comment 3•12 years ago
|
||
reduced from test case #1, still asserts
Assignee: general → dvander
Status: NEW → ASSIGNED
![]() |
Assignee | |
Comment 4•12 years ago
|
||
There were a few typos here to get these cases all working: (1) There was an inverted check, causing registers to be allocated when none were available. (2) There was a call to LAllocation::toRegister() without checking if it was a register. (3) The backedge handling of phis occurred after killing phis.
Attachment #551217 -
Flags: review?(adrake)
Reporter | ||
Updated•12 years ago
|
Attachment #551217 -
Flags: review?(adrake) → review+
Reporter | ||
Updated•12 years ago
|
![]() |
Assignee | |
Comment 5•12 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/4de8f1841fea
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•