IonMonkey: Immediate crash on startup in jsanalyze.h:633

RESOLVED DUPLICATE of bug 783008

Status

()

Core
JavaScript Engine
RESOLVED DUPLICATE of bug 783008
5 years ago
5 years ago

People

(Reporter: sstangl, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 655697 [details]
Backtrace.

Assertion failed: (u.pushed.kind == u.var.kind && u.pushed.kind == u.phi.kind) in jsanalyze.h:633. Backtrace attached. Prevents launching the browser for me with an x86_64 debug build.
(Reporter)

Comment 1

5 years ago
> types::TypeSet *poppedTypes(const jsbytecode *pc, uint32_t which) {
>     return getValueTypes(poppedValue(pc, which));
> }

(gdb) p	poppedValue(pc,	which)
$4 = (const js::analyze::SSAValue &) @0x30: <error reading variable>
IsSimpleScript is on the stack.  Regression from bug 783008?
(Reporter)

Comment 3

5 years ago
Appears so. Marking duplicate, since it was backed out.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 783008
You need to log in before you can comment on or make changes to this bug.