Closed Bug 757412 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: needsBarrier_, at ../../jscompartment.h:108 with ParallelArray

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

VERIFIED FIXED
Tracking Status
firefox-esr10 --- unaffected

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,ignore])

Attachments

(1 file)

The following testcase asserts on ionmonkey revision d80602d38aa8 (run with --ion -n -m --ion-eager):


function TestCase(n, d, e, a) {
  this.reason = '';
}
function reportCompare (expected, actual, description) {
  var output = "";
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
  testcase.reason = output;
}
var status = '';
var actual = '';
var expect= '';
reportCompare(expect, actual, status); 
gczeal(4);
var p = new ParallelArray([0,1,2,3,4]);
var summary = 'Recursive Error object should not crash';
reportCompare(expect, actual, summary);
evaluate("reportCompare(expect, actual, summary);");
Attached patch fixSplinter Review
This will be obsoleted by bug 746691, but this is a quick fix.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #626279 - Flags: review?(sstangl)
Comment on attachment 626279 [details] [diff] [review]
fix

Review of attachment 626279 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jscompartment.cpp
@@ +106,3 @@
>          mjit::ClearAllFrames(this);
> +# if defined(JS_ION)
> +		ReleaseAllJITCode(rt->defaultFreeOp(), this, true, true);

nit: uses hardtabs instead of spaces. Maybe some "vim:" line is missing from the header of this file?
Attachment #626279 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/d5545e6d927b
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
JSBugMon: This bug has been automatically verified fixed.
Status: RESOLVED → VERIFIED
backed out as http://hg.mozilla.org/projects/ionmonkey/rev/80a444262772


this is basically a dupe of bug 746691 and rather than keep hacking around it, let's wait for that.
Status: VERIFIED → REOPENED
Resolution: FIXED → ---
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 629d1e6251b9).
JSBugMon: The testcase found in this bug no longer reproduces (tried revision c76abdb11904).
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Fixed by bug 746691.
Status: REOPENED → RESOLVED
Closed: 12 years ago12 years ago
Resolution: --- → FIXED
JSBugMon: This bug has been automatically verified fixed.
Status: RESOLVED → VERIFIED
Group: core-security
You need to log in before you can comment on or make changes to this bug.