Closed Bug 737304 Opened 12 years ago Closed 12 years ago

IonMonkey: ARM Assertion failure: !entered && i < mLength, at js/Vector.h:378 with schedulegc()

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
ARM
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase) 

The following testcase asserts on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m --ion-eager) on ARM only:


function setFProperty(val) {}
function F() {}
status = schedulegc(8);
setFProperty('Hello');
actual = F.propA;
addThis();
function addThis() {
  statusitems[UBound] = status;
}


This also showed up with another assertion:

Assertion failure: unsupported relocation, at /home/decoder/ionmonkey/js/src/ion/arm/Assembler-arm.cpp:535
This doesn't reproduce for me anymore. I'll be hard to bisect since it's ARM only. 

Martin, do you know if this is really fixed?
Summary: IonMonkey: Assertion failure: !entered && i < mLength, at js/Vector.h:378 with schedulegc() → IonMonkey: ARM Assertion failure: !entered && i < mLength, at js/Vector.h:378 with schedulegc()
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.