IonMonkey: Assertion failure: !slot.isCopied() at MIRGraph.cpp:358 with LOCALINC

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: adrake, Assigned: dvander)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments, 2 obsolete attachments)

Reporter

Description

8 years ago
Posted file Test case
Attached test case asserts on ionmonkey x86 debug builds.
Reporter

Comment 1

8 years ago
Same thing happens with function parameters.
This is probably a regression that fell out of inclocal. There were problems in JM with decomposing this as well. There's something tricky about how copies are ordered.
Assignee: general → dvander
Status: NEW → ASSIGNED
Posted patch fix (obsolete) — Splinter Review
To make sure we don't copy propagate while building SSA, we carefully track copies as part of stack transitions. When setting a local variable, we have to fix up copy information, which is threaded through stack slots as a linked list.

The bug here is that when fixing up the linked list, we forget to give it a new terminator.
Attachment #554197 - Flags: review?(sstangl)
Posted patch fix (obsolete) — Splinter Review
Attachment #554197 - Attachment is obsolete: true
Attachment #554197 - Flags: review?(sstangl)
Attachment #554199 - Flags: review?
Posted patch fixSplinter Review
Attachment #554199 - Attachment is obsolete: true
Attachment #554199 - Flags: review?
Attachment #554200 - Flags: review?(sstangl)
Attachment #554200 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/084606de4f7c
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.