Last Comment Bug 763039 - IonMonkey: Assertion failure: *ptr == 0xE9, at ../ion/shared/Assembler-x86-shared.h:1164
: IonMonkey: Assertion failure: *ptr == 0xE9, at ../ion/shared/Assembler-x86-sh...
Status: RESOLVED FIXED
[jsbugmon:update]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Linux
: -- major (vote)
: ---
Assigned To: Sean Stangl [:sstangl]
:
Mentors:
: 762458 (view as bug list)
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-06-08 13:09 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:20 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Testcase for shell (1.62 KB, text/javascript)
2012-06-08 13:09 PDT, Christian Holler (:decoder)
no flags Details
patch (4.40 KB, patch)
2012-06-08 14:56 PDT, Sean Stangl [:sstangl]
dvander: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-06-08 13:09:43 PDT
Created attachment 631509 [details]
Testcase for shell

The attached testcase asserts on ionmonkey revision 5cfb73435e06 (run with --ion -n -m --ion-eager).
Comment 1 Sean Stangl [:sstangl] 2012-06-08 14:56:55 PDT
Created attachment 631538 [details] [diff] [review]
patch

IGC started after the toggledJump was emitted. Fix is to always emit barriers as disabled, then enable at the very end of compilation. Further GC action will then correctly toggle the script's barriers, since it will be reachable from a JSScript.
Comment 2 Marty Rosenberg [:mjrosenb] 2012-06-11 12:28:18 PDT
*** Bug 762458 has been marked as a duplicate of this bug. ***
Comment 3 Sean Stangl [:sstangl] 2012-06-11 12:37:45 PDT
http://hg.mozilla.org/projects/ionmonkey/rev/d4d1dd8c44d4
Comment 4 Sean Stangl [:sstangl] 2012-06-11 12:55:15 PDT
Forgot to update a header for ARM.

http://hg.mozilla.org/projects/ionmonkey/rev/ea534d594d01
Comment 5 Christian Holler (:decoder) 2013-02-07 05:20:05 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397

Note You need to log in before you can comment on or make changes to this bug.