Note: There are a few cases of duplicates in user autocompletion which are being worked on.

IM: Assertion failure: top->isEntryFrame(), at ion/Bailouts.cpp:291

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: sstangl)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 2 obsolete attachments)

(Reporter)

Description

6 years ago
The following testcase asserts on ionmonkey revision acf3c1fb7c94 (run with --ion-eager), tested on 64 bit:


function TimeFunc(func) {
    for(var y=0; y<256; y++) func(y);
}
function nestedExit2() {
    TimeFunc(TimeFunc);
}
assertEq(nestedExit2(), "ok");
Blocks: 670484
(Assignee)

Updated

6 years ago
Assignee: general → sstangl
Created attachment 566391 [details] [diff] [review]
fix
Attachment #566391 - Flags: review?(bhackett1024)
Comment on attachment 566391 [details] [diff] [review]
fix

wrong bug
Attachment #566391 - Attachment is obsolete: true
Attachment #566391 - Flags: review?(bhackett1024)
(Assignee)

Comment 3

6 years ago
Created attachment 566394 [details] [diff] [review]
Support exception handling with multiple ion frames.

This changes function call code to include the IonFramePrefix in the sizeDescriptor, which just makes everyone's life easier at the cost of an extra add instruction in the argumentsRectifier.
Attachment #566394 - Flags: review?(dvander)
(Assignee)

Comment 4

6 years ago
Created attachment 566398 [details] [diff] [review]
Same patch, but sizeDescriptor is a different delta.

Keeps sizeDescriptor as it was. The last patch omitted a required subl() in the argumentsRectifier.
Attachment #566394 - Attachment is obsolete: true
Attachment #566394 - Flags: review?(dvander)
Attachment #566398 - Flags: review?(dvander)
Attachment #566398 - Flags: review?(dvander) → review+
(Assignee)

Comment 5

6 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/7b669f558361
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Comment 6

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug692211.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.