Last Comment Bug 692211 - IM: Assertion failure: top->isEntryFrame(), at ion/Bailouts.cpp:291
: IM: Assertion failure: top->isEntryFrame(), at ion/Bailouts.cpp:291
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: Sean Stangl [:sstangl]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz 670484
  Show dependency treegraph
 
Reported: 2011-10-05 12:15 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:34 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (1.44 KB, patch)
2011-10-11 16:30 PDT, David Anderson [:dvander]
no flags Details | Diff | Splinter Review
Support exception handling with multiple ion frames. (4.48 KB, patch)
2011-10-11 16:34 PDT, Sean Stangl [:sstangl]
no flags Details | Diff | Splinter Review
Same patch, but sizeDescriptor is a different delta. (2.98 KB, patch)
2011-10-11 17:08 PDT, Sean Stangl [:sstangl]
dvander: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-10-05 12:15:24 PDT
The following testcase asserts on ionmonkey revision acf3c1fb7c94 (run with --ion-eager), tested on 64 bit:


function TimeFunc(func) {
    for(var y=0; y<256; y++) func(y);
}
function nestedExit2() {
    TimeFunc(TimeFunc);
}
assertEq(nestedExit2(), "ok");
Comment 1 David Anderson [:dvander] 2011-10-11 16:30:24 PDT
Created attachment 566391 [details] [diff] [review]
fix
Comment 2 David Anderson [:dvander] 2011-10-11 16:33:09 PDT
Comment on attachment 566391 [details] [diff] [review]
fix

wrong bug
Comment 3 Sean Stangl [:sstangl] 2011-10-11 16:34:51 PDT
Created attachment 566394 [details] [diff] [review]
Support exception handling with multiple ion frames.

This changes function call code to include the IonFramePrefix in the sizeDescriptor, which just makes everyone's life easier at the cost of an extra add instruction in the argumentsRectifier.
Comment 4 Sean Stangl [:sstangl] 2011-10-11 17:08:50 PDT
Created attachment 566398 [details] [diff] [review]
Same patch, but sizeDescriptor is a different delta.

Keeps sizeDescriptor as it was. The last patch omitted a required subl() in the argumentsRectifier.
Comment 5 Sean Stangl [:sstangl] 2011-10-11 17:37:55 PDT
http://hg.mozilla.org/projects/ionmonkey/rev/7b669f558361
Comment 6 Christian Holler (:decoder) 2013-01-14 08:34:39 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug692211.js.

Note You need to log in before you can comment on or make changes to this bug.