Closed Bug 754155 Opened 10 years ago Closed 10 years ago

IonMonkey: AssertReversePostOrder failure on test_localStorageOriginsEquals.html

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: dvander, Unassigned)

References

Details

Attachments

(1 file)

Assertion is firing on this line:

735	            JS_ASSERT_IF(!pred->isLoopBackedge(), pred->isMarked());
This function involves a LOOKUPSWITCH, so might be related to that recent landing.
Mostly an RPO fix.  I was moveBlockToEnd-ing all the blocks after creation, but this didn't handle the case where case body blocks could have sub-blocks created when they were being processed.

The moveBlockToEnd needs to happen on a body block immediately before it is processed, to ensure it makes it past the cond blocks, as well as any previous body block that has been processed.
Attachment #623256 - Flags: review?(dvander)
Attachment #623256 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/7b00180f4f34
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.