Closed Bug 737300 Opened 9 years ago Closed 9 years ago

IonMonkey: Assertion failure: defdata->classPrev == __null, at ion/ValueNumbering.cpp:464

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The following testcase asserts on ionmonkey revision b5b6e6aebb36 (run with --ion -n -m --ion-eager):


function loopy(p0)
{
 var r3 = p0;
 var r4 = p0;
 var r6 = p0;
 var r7 = p0;
 while (r2) {
  while (r2) {
   r5 = r6 & r1;
   r3 = r4 & r3;
   r2 = r7;
  }
 }
}
loopy(0);
well, *that* was a silly bug
Attachment #608207 - Flags: review?(jdemooij)
Comment on attachment 608207 [details] [diff] [review]
/home/mrosenberg/patches/gvn_fix-r2.patch

Review of attachment 608207 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch. The patch has some unrelated comment changes, were these intended?

::: js/src/ion/ValueNumbering.h
@@ +149,4 @@
>          if (classNext)
>              classNext->valueNumberData()->classPrev = classPrev;
>          if (classPrev)
>              classPrev->valueNumberData()->classPrev = classNext;

Pre-existing, but I think the last line should be:

classPrev->valueNumberData()->classNext = classNext;
Attachment #608207 - Flags: review?(jdemooij) → review+
landed: http://hg.mozilla.org/projects/ionmonkey/rev/15da4376607b
And yes, those comments were unrelated, they were pushed back into the previous patch.
Fixed per comment 3.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.