IonMonkey: snapshot_ already set in assignPostSnapshot()

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: sstangl, Assigned: nbp)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

In jit-test/tests/basic/bug532823.js on master:

Assertion failure: !snapshot_, at /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

This is inside assignPostSnapshot().

Probably because visitCall() does:
> assignSnapshot(ins)
> assignPostSnapshot(ins)

which can't be correct if that assert is valid. Nicolas?
(In reply to Sean Stangl from comment #0)
> In jit-test/tests/basic/bug532823.js on master:
> 
> Assertion failure: !snapshot_, at
> /home/sstangl/dev/ionmonkey/js/src/ion/IonLIR.cpp:283

Hum, my mistake, the LIRInstruction::assignPostSnapshot function should assert for that postSnapshot_ is not already set.

> This is inside assignPostSnapshot().
> 
> Probably because visitCall() does:
> > assignSnapshot(ins)
> > assignPostSnapshot(ins)
> 
> which can't be correct if that assert is valid. Nicolas?

This is correct, because a call may bailout before making the call and can use the postSnapshot (Safepoint) after making the call.
Assignee: general → nicolas.b.pierron
https://hg.mozilla.org/projects/ionmonkey/rev/c1fbc6e49167
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.