692211 - IM: Assertion failure: top->isEntryFrame(), at ion/Bailouts.cpp:291

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision acf3c1fb7c94 (run with --ion-eager), tested on 64 bit:


function TimeFunc(func) {
    for(var y=0; y<256; y++) func(y);
}
function nestedExit2() {
    TimeFunc(TimeFunc);
}
assertEq(nestedExit2(), "ok");

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 566391 [details] [diff] [review]
fix

wrong bug

Comment 3

[Sean Stangl [:sstangl]]

Attachment: Support exception handling with multiple ion frames.

This changes function call code to include the IonFramePrefix in the sizeDescriptor, which just makes everyone's life easier at the cost of an extra add instruction in the argumentsRectifier.

Comment 4

[Sean Stangl [:sstangl]]

Attachment: Same patch, but sizeDescriptor is a different delta.

Keeps sizeDescriptor as it was. The last patch omitted a required subl() in the argumentsRectifier.

Comment 5

[Sean Stangl [:sstangl]]

http://hg.mozilla.org/projects/ionmonkey/rev/7b669f558361

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug692211.js.