706303 - IonMonkey: snapshot_ already set in assignPostSnapshot()

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

In jit-test/tests/basic/bug532823.js on master:

Assertion failure: !snapshot_, at /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

This is inside assignPostSnapshot().

Probably because visitCall() does:
> assignSnapshot(ins)
> assignPostSnapshot(ins)

which can't be correct if that assert is valid. Nicolas?

Comment 1

[Nicolas B. Pierron [:nbp]]

(In reply to Sean Stangl from comment #0)
> In jit-test/tests/basic/bug532823.js on master:
> 
> Assertion failure: !snapshot_, at
> /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

Hum, my mistake, the LIRInstruction::assignPostSnapshot function should assert for that postSnapshot_ is not already set.

> This is inside assignPostSnapshot().
> 
> Probably because visitCall() does:
> > assignSnapshot(ins)
> > assignPostSnapshot(ins)
> 
> which can't be correct if that assert is valid. Nicolas?

This is correct, because a call may bailout before making the call and can use the postSnapshot (Safepoint) after making the call.

Comment 2

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/projects/ionmonkey/rev/c1fbc6e49167