Closed
Bug 692382
Opened 13 years ago
Closed 13 years ago
IonMonkey: 10/05 merge has gone awry.
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Assigned: sstangl)
Details
Attachments
(1 file)
969 bytes,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
Before merge, 2 jit-test failures on x64 --ion-eager. After merge, 377 jit-test failures on x64 --ion-eager. I will look into this.
Assignee | ||
Comment 1•13 years ago
|
||
The crashes are in IonActivation::~IonActivation(), when resetting the stack regs. In the IonActivation constructor, we repointRegs(NULL), and save the old registers. In the IonActivation destructor, we repointRegs(oldRegs) -- but post-merge, ContextStack::repointRegs() now contains an assertion that regs hasfp(). But we set it to NULL. So we crash. Since IonActivation knows the new fp, we could just set it in the new FrameRegs, hiding the others.
Assignee | ||
Comment 2•13 years ago
|
||
Still ~110 crashes. Will handle in the morning.
Sorry, that was merge bustage on my part. We removed the assert in Ion and got it back accidentally. Let's just get it removed on m-c.
Assignee | ||
Comment 4•13 years ago
|
||
Attachment #565387 -
Flags: review?(luke)
Assignee | ||
Comment 5•13 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/3ee51d2222b1 Pushed the above patch to IM branch.
Updated•13 years ago
|
Attachment #565387 -
Flags: review?(luke) → review+
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Updated•13 years ago
|
Resolution: WORKSFORME → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•