IonMonkey: Assertion failure: isObject(), at ../../jsapi.h:476 or Crash [@ js::UnwindIteratorForUncatchableException]

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: dvander)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision 4ce3983a43f4 (run with --ion -n -m --ion-eager):


function testNestedForIn() {
    var a = {x: 1, y: (/\\u00fd[]/ ), z: 3};
    for (var p1 in a)
        for (var { w  }  = 0     ;  ;    )
            testJSON(t);
}
assertEq(testNestedForIn(), 'xx xy xz yx yy yz zx zy zz ');
(Assignee)

Updated

5 years ago
Assignee: general → dvander
Status: NEW → ASSIGNED
(Assignee)

Comment 1

5 years ago
Created attachment 628371 [details] [diff] [review]
fix

The bug is that an inner loop creates a phi for an iterator object, but this phi is not observable so it gets removed. The fix here should scale easily to chunked compilation.
Attachment #628371 - Flags: review?(jdemooij)
Comment on attachment 628371 [details] [diff] [review]
fix

Review of attachment 628371 [details] [diff] [review]:
-----------------------------------------------------------------

Nice.
Attachment #628371 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 3

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/0930379f5cfa
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Assignee)

Updated

5 years ago
Duplicate of this bug: 759314
(Reporter)

Comment 5

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug759213.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.