Closed
Bug 706303
Opened 13 years ago
Closed 13 years ago
IonMonkey: snapshot_ already set in assignPostSnapshot()
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Assigned: nbp)
References
Details
In jit-test/tests/basic/bug532823.js on master: Assertion failure: !snapshot_, at /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283 This is inside assignPostSnapshot(). Probably because visitCall() does: > assignSnapshot(ins) > assignPostSnapshot(ins) which can't be correct if that assert is valid. Nicolas?
Assignee | ||
Comment 1•13 years ago
|
||
(In reply to Sean Stangl from comment #0) > In jit-test/tests/basic/bug532823.js on master: > > Assertion failure: !snapshot_, at > /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283 Hum, my mistake, the LIRInstruction::assignPostSnapshot function should assert for that postSnapshot_ is not already set. > This is inside assignPostSnapshot(). > > Probably because visitCall() does: > > assignSnapshot(ins) > > assignPostSnapshot(ins) > > which can't be correct if that assert is valid. Nicolas? This is correct, because a call may bailout before making the call and can use the postSnapshot (Safepoint) after making the call.
Assignee | ||
Updated•13 years ago
|
Assignee: general → nicolas.b.pierron
Assignee | ||
Comment 2•13 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/c1fbc6e49167
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•