Last Comment Bug 754155 - IonMonkey: AssertReversePostOrder failure on test_localStorageOriginsEquals.html
: IonMonkey: AssertReversePostOrder failure on test_localStorageOriginsEquals.html
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: IonGreen
  Show dependency treegraph
 
Reported: 2012-05-10 18:59 PDT by David Anderson [:dvander]
Modified: 2012-05-14 10:51 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Minor change to fix RPO (1.80 KB, patch)
2012-05-11 12:38 PDT, Kannan Vijayan [:djvj]
dvander: review+
Details | Diff | Review

Description David Anderson [:dvander] 2012-05-10 18:59:46 PDT
Assertion is firing on this line:

735	            JS_ASSERT_IF(!pred->isLoopBackedge(), pred->isMarked());
Comment 1 David Anderson [:dvander] 2012-05-10 19:01:50 PDT
This function involves a LOOKUPSWITCH, so might be related to that recent landing.
Comment 2 Kannan Vijayan [:djvj] 2012-05-11 12:38:25 PDT
Created attachment 623256 [details] [diff] [review]
Minor change to fix RPO

Mostly an RPO fix.  I was moveBlockToEnd-ing all the blocks after creation, but this didn't handle the case where case body blocks could have sub-blocks created when they were being processed.

The moveBlockToEnd needs to happen on a body block immediately before it is processed, to ensure it makes it past the cond blocks, as well as any previous body block that has been processed.
Comment 3 Kannan Vijayan [:djvj] 2012-05-14 10:51:57 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/7b00180f4f34

Note You need to log in before you can comment on or make changes to this bug.