858586 - IonMonkey: Assertion failure: cache->useCount() == 0, at ion/IonBuilder.cpp:3583

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 55f9e3e3dae7 (run with --ion-eager):


function A(a) { this.a = a; }
A.prototype.foo = function (x) {};
function B(b) { this.b = b; }
B.prototype.foo = function (x) {};
function C(c) {}
function makeArray(n) {
    var classes = [A, B, C];
    var arr = [];
    for (var i = 0; i < n; i++) {
        arr.push(new classes[i % 3](i % 3));
    }
    return arr;
}
function runner(arr, resultArray, len) {
    for (var i = 0; i < len; i++) {
        var obj = arr[i];
        resultArray[0] += obj.foo(i);
    }
}
var resultArray = [0];
var arr = makeArray(30000);
C.prototype.foo = Uint8ClampedArray;
runner(arr, resultArray, 30000);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   126654:a92c968b29ae
user:        Sean Stangl
date:        Tue Feb 19 14:06:40 2013 -0800
summary:     Bug 837312: IonMonkey: Inline a strict subset of known targets, r=sstangl,djvj

This iteration took 11.002 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo from Sean, based on comment 2 :)

Comment 4

[Sean Stangl [:sstangl]]

Attachment: fix

replaceOperand() was incorrectly used in place of discardOperand().

Comment 5

[Hannes Verschore [:h4writer]]

Comment on attachment 758898 [details] [diff] [review]
fix

Review of attachment 758898 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch. Can you include testcase.

Comment 6

[Sean Stangl [:sstangl]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/611893aff336

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/611893aff336