Last Comment Bug 706303 - IonMonkey: snapshot_ already set in assignPostSnapshot()
: IonMonkey: snapshot_ already set in assignPostSnapshot()
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: 695887
  Show dependency treegraph
 
Reported: 2011-11-29 15:35 PST by Sean Stangl [:sstangl]
Modified: 2011-11-29 15:50 PST (History)
1 user (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Sean Stangl [:sstangl] 2011-11-29 15:35:28 PST
In jit-test/tests/basic/bug532823.js on master:

Assertion failure: !snapshot_, at /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

This is inside assignPostSnapshot().

Probably because visitCall() does:
> assignSnapshot(ins)
> assignPostSnapshot(ins)

which can't be correct if that assert is valid. Nicolas?
Comment 1 Nicolas B. Pierron [:nbp] 2011-11-29 15:45:40 PST
(In reply to Sean Stangl from comment #0)
> In jit-test/tests/basic/bug532823.js on master:
> 
> Assertion failure: !snapshot_, at
> /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

Hum, my mistake, the LIRInstruction::assignPostSnapshot function should assert for that postSnapshot_ is not already set.

> This is inside assignPostSnapshot().
> 
> Probably because visitCall() does:
> > assignSnapshot(ins)
> > assignPostSnapshot(ins)
> 
> which can't be correct if that assert is valid. Nicolas?

This is correct, because a call may bailout before making the call and can use the postSnapshot (Safepoint) after making the call.
Comment 2 Nicolas B. Pierron [:nbp] 2011-11-29 15:50:54 PST
https://hg.mozilla.org/projects/ionmonkey/rev/c1fbc6e49167

Note You need to log in before you can comment on or make changes to this bug.