IonMonkey: Assertion failure: *ptr == 0xE9, at ../ion/shared/Assembler-x86-shared.h:1164

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: sstangl)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 631509 [details]
Testcase for shell

The attached testcase asserts on ionmonkey revision 5cfb73435e06 (run with --ion -n -m --ion-eager).
(Assignee)

Updated

5 years ago
Assignee: general → sstangl
(Assignee)

Comment 1

5 years ago
Created attachment 631538 [details] [diff] [review]
patch

IGC started after the toggledJump was emitted. Fix is to always emit barriers as disabled, then enable at the very end of compilation. Further GC action will then correctly toggle the script's barriers, since it will be reachable from a JSScript.
Attachment #631538 - Flags: review?(dvander)
Attachment #631538 - Flags: review?(dvander) → review+
Duplicate of this bug: 762458
(Assignee)

Comment 3

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/d4d1dd8c44d4
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Assignee)

Comment 4

5 years ago
Forgot to update a header for ARM.

http://hg.mozilla.org/projects/ionmonkey/rev/ea534d594d01
(Reporter)

Comment 5

5 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.