Closed Bug 683983 Opened 10 years ago Closed 10 years ago

IonMonkey: Crash building SSA on mjit test

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: dvander, Assigned: dvander)

References

Details

Attachments

(1 file)

Crashes on jit-test/tests/jaeger/bug642198.js:

#0  0x0844029b in js::ion::MBasicBlock::getSlot (this=0x0, index=1) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/MIRGraph.cpp:178
#1  0x08441ad9 in js::ion::MBasicBlock::inheritPhis (this=0x0, header=0x856fbc0) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/MIRGraph.cpp:717
#2  0x0843a074 in js::ion::IonBuilder::finishLoop (this=0xffffc14c, state=..., successor=0x0) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/IonBuilder.cpp:684
#3  0x0843a6cc in js::ion::IonBuilder::processForUpdateEnd (this=0xffffc14c, state=...) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/IonBuilder.cpp:845
Attached patch fixSplinter Review
If a loop looks like:

  for (init; true; update) {
      if (cond)
          break;
  }

It will have no successor, but a break block, so finishLoop() needs to just check whether there is a successor.
Attachment #557595 - Flags: review?(cdleary)
Comment on attachment 557595 [details] [diff] [review]
fix

Think I have a good understanding of this builder now. Did you mean to leave the |dis| in the test?
Attachment #557595 - Flags: review?(cdleary) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/61cd956864cc
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.