Closed Bug 759213 Opened 9 years ago Closed 9 years ago

IonMonkey: Assertion failure: isObject(), at ../../jsapi.h:476 or Crash [@ js::UnwindIteratorForUncatchableException]

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase asserts on ionmonkey revision 4ce3983a43f4 (run with --ion -n -m --ion-eager):


function testNestedForIn() {
    var a = {x: 1, y: (/\\u00fd[]/ ), z: 3};
    for (var p1 in a)
        for (var { w  }  = 0     ;  ;    )
            testJSON(t);
}
assertEq(testNestedForIn(), 'xx xy xz yx yy yz zx zy zz ');
Assignee: general → dvander
Status: NEW → ASSIGNED
Attached patch fixSplinter Review
The bug is that an inner loop creates a phi for an iterator object, but this phi is not observable so it gets removed. The fix here should scale easily to chunked compilation.
Attachment #628371 - Flags: review?(jdemooij)
Comment on attachment 628371 [details] [diff] [review]
fix

Review of attachment 628371 [details] [diff] [review]:
-----------------------------------------------------------------

Nice.
Attachment #628371 - Flags: review?(jdemooij) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/0930379f5cfa
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Duplicate of this bug: 759314
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug759213.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.