Closed Bug 669950 Opened 13 years ago Closed 13 years ago

IonMonkey: Assertion failure: index < stackDepth_, at MIR.h:843

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: dvander)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

--
(function () {
    var x = true ? 1 : 2;
})();
--
Asserts at revision 938e06c2ee03:

Assertion failure: index < stackDepth_, at MIR.h:843
Blocks: anion
No longer blocks: IonMonkey
Attached patch fixSplinter Review
Whoops. We were taking a block's entry snapshot before we knew its stack depth.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #551276 - Flags: review?(sstangl)
(Ignore that breakpoint.)
Blocks: IonMonkey
No longer blocks: anion
Comment on attachment 551276 [details] [diff] [review]
fix

Review of attachment 551276 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/MIRGraph.cpp
@@ +448,5 @@
>  
>  bool
>  MBasicBlock::addPredecessor(MBasicBlock *pred)
>  {
> +    JS_ASSERT(predecessors_.length() > 0);

Unused control flow elimination uses addPredecessor() to update predecessor information, so it may actually be the case that a block temporarily has no predecessors. No changes needed in this patch, though.
Attachment #551276 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/8f2bd72cec88
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.