IonMonkey: Assertion failure: defdata->classPrev == __null, at ion/ValueNumbering.cpp:464

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision b5b6e6aebb36 (run with --ion -n -m --ion-eager):


function loopy(p0)
{
 var r3 = p0;
 var r4 = p0;
 var r6 = p0;
 var r7 = p0;
 while (r2) {
  while (r2) {
   r5 = r6 & r1;
   r3 = r4 & r3;
   r2 = r7;
  }
 }
}
loopy(0);
Created attachment 608207 [details] [diff] [review]
/home/mrosenberg/patches/gvn_fix-r2.patch

well, *that* was a silly bug
Attachment #608207 - Flags: review?(jdemooij)
Comment on attachment 608207 [details] [diff] [review]
/home/mrosenberg/patches/gvn_fix-r2.patch

Review of attachment 608207 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch. The patch has some unrelated comment changes, were these intended?

::: js/src/ion/ValueNumbering.h
@@ +149,4 @@
>          if (classNext)
>              classNext->valueNumberData()->classPrev = classPrev;
>          if (classPrev)
>              classPrev->valueNumberData()->classPrev = classNext;

Pre-existing, but I think the last line should be:

classPrev->valueNumberData()->classNext = classNext;
Attachment #608207 - Flags: review?(jdemooij) → review+
landed: http://hg.mozilla.org/projects/ionmonkey/rev/15da4376607b
And yes, those comments were unrelated, they were pushed back into the previous patch.
(Reporter)

Comment 4

5 years ago
Fixed per comment 3.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 5

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.