Closed Bug 679581 Opened 8 years ago Closed 8 years ago

IonMonkey: Assertion failure: mode() == TYPED_REG && knownType() != JSVAL_TYPE_DOUBLE, at Snapshots.h:182 with LSRA

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: dvander)

References

(Blocks 1 open bug)

Details

Attachments

(2 files)

Attached file Test case
Attached test case dies during bailout on ionmonkey tip, x86 debug builds with lsra enabled.
Attached patch fixSplinter Review
Simple bug in reading doubles off the stack when bailing out. I also added some spew to help debug things like this:

[Snapshots] Encoding snapshot 0x85686e0 (nfixed 5) (exprStack 0)
[Snapshots]     slot 0: value (t=144, d=140)
[Snapshots]     slot 1: int32 (stack 148)
[Snapshots]     slot 2: undefined
[Snapshots]     slot 3: value (t=124, d=edi)
[Snapshots]     slot 4: double (stack 112)
[Snapshots]     total size: 23 bytes
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #554548 - Flags: review?(sstangl)
Attachment #554548 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/b9abc23063b9
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.