Closed
Bug 692211
Opened 13 years ago
Closed 13 years ago
IM: Assertion failure: top->isEntryFrame(), at ion/Bailouts.cpp:291
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: sstangl)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file, 2 obsolete files)
2.98 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision acf3c1fb7c94 (run with --ion-eager), tested on 64 bit: function TimeFunc(func) { for(var y=0; y<256; y++) func(y); } function nestedExit2() { TimeFunc(TimeFunc); } assertEq(nestedExit2(), "ok");
Assignee | ||
Updated•13 years ago
|
Assignee: general → sstangl
Attachment #566391 -
Flags: review?(bhackett1024)
Comment on attachment 566391 [details] [diff] [review] fix wrong bug
Attachment #566391 -
Attachment is obsolete: true
Attachment #566391 -
Flags: review?(bhackett1024)
Assignee | ||
Comment 3•13 years ago
|
||
This changes function call code to include the IonFramePrefix in the sizeDescriptor, which just makes everyone's life easier at the cost of an extra add instruction in the argumentsRectifier.
Attachment #566394 -
Flags: review?(dvander)
Assignee | ||
Comment 4•13 years ago
|
||
Keeps sizeDescriptor as it was. The last patch omitted a required subl() in the argumentsRectifier.
Attachment #566394 -
Attachment is obsolete: true
Attachment #566394 -
Flags: review?(dvander)
Attachment #566398 -
Flags: review?(dvander)
Updated•13 years ago
|
Attachment #566398 -
Flags: review?(dvander) → review+
Assignee | ||
Comment 5•13 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/7b669f558361
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 6•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug692211.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•