The default bug view has changed. See this FAQ.

IonMonkey: AssertReversePostOrder failure on test_localStorageOriginsEquals.html

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: dvander, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Assertion is firing on this line:

735	            JS_ASSERT_IF(!pred->isLoopBackedge(), pred->isMarked());
(Reporter)

Comment 1

5 years ago
This function involves a LOOKUPSWITCH, so might be related to that recent landing.
Created attachment 623256 [details] [diff] [review]
Minor change to fix RPO

Mostly an RPO fix.  I was moveBlockToEnd-ing all the blocks after creation, but this didn't handle the case where case body blocks could have sub-blocks created when they were being processed.

The moveBlockToEnd needs to happen on a body block immediately before it is processed, to ensure it makes it past the cond blocks, as well as any previous body block that has been processed.
Attachment #623256 - Flags: review?(dvander)
(Reporter)

Updated

5 years ago
Attachment #623256 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/7b00180f4f34
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.