754155 - IonMonkey: AssertReversePostOrder failure on test_localStorageOriginsEquals.html

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Assertion is firing on this line:

735	            JS_ASSERT_IF(!pred->isLoopBackedge(), pred->isMarked());

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This function involves a LOOKUPSWITCH, so might be related to that recent landing.

Comment 2

[Kannan Vijayan [:djvj]]

Attachment: Minor change to fix RPO

Mostly an RPO fix.  I was moveBlockToEnd-ing all the blocks after creation, but this didn't handle the case where case body blocks could have sub-blocks created when they were being processed.

The moveBlockToEnd needs to happen on a body block immediately before it is processed, to ensure it makes it past the cond blocks, as well as any previous body block that has been processed.

Comment 3

[Kannan Vijayan [:djvj]]

https://hg.mozilla.org/projects/ionmonkey/rev/7b00180f4f34