Note: There are a few cases of duplicates in user autocompletion which are being worked on.

IonMonkey: snapshot_ already set in assignPostSnapshot()

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: sstangl, Assigned: nbp)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
In jit-test/tests/basic/bug532823.js on master:

Assertion failure: !snapshot_, at /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

This is inside assignPostSnapshot().

Probably because visitCall() does:
> assignSnapshot(ins)
> assignPostSnapshot(ins)

which can't be correct if that assert is valid. Nicolas?
(Assignee)

Comment 1

6 years ago
(In reply to Sean Stangl from comment #0)
> In jit-test/tests/basic/bug532823.js on master:
> 
> Assertion failure: !snapshot_, at
> /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

Hum, my mistake, the LIRInstruction::assignPostSnapshot function should assert for that postSnapshot_ is not already set.

> This is inside assignPostSnapshot().
> 
> Probably because visitCall() does:
> > assignSnapshot(ins)
> > assignPostSnapshot(ins)
> 
> which can't be correct if that assert is valid. Nicolas?

This is correct, because a call may bailout before making the call and can use the postSnapshot (Safepoint) after making the call.
(Assignee)

Updated

6 years ago
Assignee: general → nicolas.b.pierron
(Assignee)

Comment 2

6 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/c1fbc6e49167
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.