678620 - IonMonkey: Assertion failure: !slot.isCopied() at MIRGraph.cpp:358 with LOCALINC

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andrew Drake [:adrake]]

Attachment: Test case

Attached test case asserts on ionmonkey x86 debug builds.

Comment 1

[Andrew Drake [:adrake]]

Attachment: Test case w/ parameters

Same thing happens with function parameters.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

This is probably a regression that fell out of inclocal. There were problems in JM with decomposing this as well. There's something tricky about how copies are ordered.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

To make sure we don't copy propagate while building SSA, we carefully track copies as part of stack transitions. When setting a local variable, we have to fix up copy information, which is threaded through stack slots as a linked list.

The bug here is that when fixing up the linked list, we forget to give it a new terminator.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/084606de4f7c