Last Comment Bug 754718 - IonMonkey: Assertion failure: enumerators == cx->enumerators, at jsinterp.cpp:464 or Crash [@ js::UnwindIteratorForUncatchableException]
: IonMonkey: Assertion failure: enumerators == cx->enumerators, at jsinterp.cpp...
Status: RESOLVED FIXED
[jsbugmon:update]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
:
Mentors:
: 746364 754715 754717 (view as bug list)
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-05-13 15:18 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:19 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (4.68 KB, patch)
2012-05-14 17:22 PDT, David Anderson [:dvander]
nicolas.b.pierron: review+
Details | Diff | Review

Description Christian Holler (:decoder) 2012-05-13 15:18:38 PDT
The following testcase asserts on ionmonkey revision e8de64e7e9fe (run with --ion -n -m --ion-eager):


(function() {
  var a, b;
  for each (a in [{}, {__iterator__: function(){}}]) 
    for (b in a) { }
})();
Comment 1 David Anderson [:dvander] 2012-05-14 17:22:50 PDT
Created attachment 623881 [details] [diff] [review]
fix

Hoping this will fix some of the other GC bugs we've encountered. Two bugs:

 (1) PushRegsInMask stores in the wrong order.
 (2) MarkIonFrames didn't always decrement the spill position.
Comment 2 Nicolas B. Pierron [:nbp] 2012-05-14 17:40:43 PDT
Comment on attachment 623881 [details] [diff] [review]
fix

Review of attachment 623881 [details] [diff] [review]:
-----------------------------------------------------------------

Good catches.
Comment 3 David Anderson [:dvander] 2012-05-14 18:24:07 PDT
*** Bug 754715 has been marked as a duplicate of this bug. ***
Comment 4 David Anderson [:dvander] 2012-05-14 18:28:13 PDT
checked in with a thinko fixed:  http://hg.mozilla.org/projects/ionmonkey/rev/d3593b87e0af
Comment 5 David Anderson [:dvander] 2012-05-14 18:32:42 PDT
*** Bug 754717 has been marked as a duplicate of this bug. ***
Comment 6 David Anderson [:dvander] 2012-05-14 18:45:16 PDT
*** Bug 746364 has been marked as a duplicate of this bug. ***
Comment 7 Christian Holler (:decoder) 2013-01-14 08:19:56 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug754718.js.

Note You need to log in before you can comment on or make changes to this bug.