Closed Bug 706303 Opened 13 years ago Closed 13 years ago

IonMonkey: snapshot_ already set in assignPostSnapshot()

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: sstangl, Assigned: nbp)

References

Details

In jit-test/tests/basic/bug532823.js on master:

Assertion failure: !snapshot_, at /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

This is inside assignPostSnapshot().

Probably because visitCall() does:
> assignSnapshot(ins)
> assignPostSnapshot(ins)

which can't be correct if that assert is valid. Nicolas?
(In reply to Sean Stangl from comment #0)
> In jit-test/tests/basic/bug532823.js on master:
> 
> Assertion failure: !snapshot_, at
> /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

Hum, my mistake, the LIRInstruction::assignPostSnapshot function should assert for that postSnapshot_ is not already set.

> This is inside assignPostSnapshot().
> 
> Probably because visitCall() does:
> > assignSnapshot(ins)
> > assignPostSnapshot(ins)
> 
> which can't be correct if that assert is valid. Nicolas?

This is correct, because a call may bailout before making the call and can use the postSnapshot (Safepoint) after making the call.
Assignee: general → nicolas.b.pierron
https://hg.mozilla.org/projects/ionmonkey/rev/c1fbc6e49167
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.