Closed Bug 678620 Opened 13 years ago Closed 13 years ago

IonMonkey: Assertion failure: !slot.isCopied() at MIRGraph.cpp:358 with LOCALINC

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: dvander)

References

(Blocks 1 open bug)

Details

Attachments

(3 files, 2 obsolete files)

Attached file Test case
Attached test case asserts on ionmonkey x86 debug builds.
Same thing happens with function parameters.
This is probably a regression that fell out of inclocal. There were problems in JM with decomposing this as well. There's something tricky about how copies are ordered.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attached patch fix (obsolete) — Splinter Review
To make sure we don't copy propagate while building SSA, we carefully track copies as part of stack transitions. When setting a local variable, we have to fix up copy information, which is threaded through stack slots as a linked list.

The bug here is that when fixing up the linked list, we forget to give it a new terminator.
Attachment #554197 - Flags: review?(sstangl)
Attached patch fix (obsolete) — Splinter Review
Attachment #554197 - Attachment is obsolete: true
Attachment #554197 - Flags: review?(sstangl)
Attachment #554199 - Flags: review?
Attached patch fixSplinter Review
Attachment #554199 - Attachment is obsolete: true
Attachment #554199 - Flags: review?
Attachment #554200 - Flags: review?(sstangl)
Attachment #554200 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/084606de4f7c
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.