IonMonkey: Assertion failure: index < stackPosition_, at ion/MIRGraph.cpp:346

RESOLVED FIXED in mozilla23

Status

()

defect
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks 1 bug, {assertion, testcase})

Trunk
mozilla23
x86_64
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

The following testcase asserts on mozilla-central revision 05533d50f2f7 (run with --ion-eager):


a: for (var i = 0 of [1, 2, 3]) {
  for (var k = 0 ; ; 1) {
            break a;
  }
}
Blocks: IonFuzz
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   129606:9aff2a52d88b
user:        Brian Hackett
date:        Mon Apr 22 20:22:30 2013 -0600
summary:     Bug 863518 - Consider types added by loop body when unboxing OSR values, r=dvander.

This iteration took 0.912 seconds to run.
Brian, can you take a look based on comment 1? :)
Posted patch patchSplinter Review
Similar to bug 865192, in this case the stack depth at the current point for the loop header doesn't match those of other blocks because of the break from the loop.  What's really intended here is to get the phi types at the start of the loop, not wherever the header happens to be; this patch changes things to get these types from the header's initial phis.
Attachment #744181 - Flags: review?(dvander)
Attachment #744181 - Flags: review?(dvander) → review+
https://hg.mozilla.org/mozilla-central/rev/0a050b75a9af
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.