Closed Bug 759213 Opened 11 years ago Closed 11 years ago

IonMonkey: Assertion failure: isObject(), at ../../jsapi.h:476 or Crash [@ js::UnwindIteratorForUncatchableException]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

fix
5.37 KB, patch
jandem
: review+
Details | Diff | Splinter Review 
The following testcase asserts on ionmonkey revision 4ce3983a43f4 (run with --ion -n -m --ion-eager):


function testNestedForIn() {
    var a = {x: 1, y: (/\\u00fd[]/ ), z: 3};
    for (var p1 in a)
        for (var { w  }  = 0     ;  ;    )
            testJSON(t);
}
assertEq(testNestedForIn(), 'xx xy xz yx yy yz zx zy zz ');
Assignee: general → dvander
Status: NEW → ASSIGNED
Attached patch fix — — Splinter Review 
The bug is that an inner loop creates a phi for an iterator object, but this phi is not observable so it gets removed. The fix here should scale easily to chunked compilation.
Attachment #628371 - Flags: review?(jdemooij)
Comment on attachment 628371 [details] [diff] [review]
fix

Review of attachment 628371 [details] [diff] [review]:
-----------------------------------------------------------------

Nice.
Attachment #628371 - Flags: review?(jdemooij) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/0930379f5cfa
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug759213.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.