Closed
Bug 754155
Opened 12 years ago
Closed 12 years ago
IonMonkey: AssertReversePostOrder failure on test_localStorageOriginsEquals.html
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: dvander, Unassigned)
References
Details
Attachments
(1 file)
1.80 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
Assertion is firing on this line: 735 JS_ASSERT_IF(!pred->isLoopBackedge(), pred->isMarked());
Reporter | ||
Comment 1•12 years ago
|
||
This function involves a LOOKUPSWITCH, so might be related to that recent landing.
Comment 2•12 years ago
|
||
Mostly an RPO fix. I was moveBlockToEnd-ing all the blocks after creation, but this didn't handle the case where case body blocks could have sub-blocks created when they were being processed. The moveBlockToEnd needs to happen on a body block immediately before it is processed, to ensure it makes it past the cond blocks, as well as any previous body block that has been processed.
Attachment #623256 -
Flags: review?(dvander)
Reporter | ||
Updated•12 years ago
|
Attachment #623256 -
Flags: review?(dvander) → review+
Comment 3•12 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/7b00180f4f34
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•