Closed Bug 858586 Opened 7 years ago Closed 6 years ago

IonMonkey: Assertion failure: cache->useCount() == 0, at ion/IonBuilder.cpp:3583

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla24

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

The following testcase asserts on mozilla-central revision 55f9e3e3dae7 (run with --ion-eager):


function A(a) { this.a = a; }
A.prototype.foo = function (x) {};
function B(b) { this.b = b; }
B.prototype.foo = function (x) {};
function C(c) {}
function makeArray(n) {
    var classes = [A, B, C];
    var arr = [];
    for (var i = 0; i < n; i++) {
        arr.push(new classes[i % 3](i % 3));
    }
    return arr;
}
function runner(arr, resultArray, len) {
    for (var i = 0; i < len; i++) {
        var obj = arr[i];
        resultArray[0] += obj.foo(i);
    }
}
var resultArray = [0];
var arr = makeArray(30000);
C.prototype.foo = Uint8ClampedArray;
runner(arr, resultArray, 30000);
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   126654:a92c968b29ae
user:        Sean Stangl
date:        Tue Feb 19 14:06:40 2013 -0800
summary:     Bug 837312: IonMonkey: Inline a strict subset of known targets, r=sstangl,djvj

This iteration took 11.002 seconds to run.
Needinfo from Sean, based on comment 2 :)
Flags: needinfo?(sstangl)
Attached patch fixSplinter Review
replaceOperand() was incorrectly used in place of discardOperand().
Attachment #758898 - Flags: review?(hv1989)
Flags: needinfo?(sstangl)
Comment on attachment 758898 [details] [diff] [review]
fix

Review of attachment 758898 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch. Can you include testcase.
Attachment #758898 - Flags: review?(hv1989) → review+
Flags: in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/611893aff336
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.