Closed
Bug 866866
Opened 9 years ago
Closed 9 years ago
IonMonkey: Assertion failure: index < stackPosition_, at ion/MIRGraph.cpp:346
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla23
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
1.53 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on mozilla-central revision 05533d50f2f7 (run with --ion-eager): a: for (var i = 0 of [1, 2, 3]) { for (var k = 0 ; ; 1) { break a; } }
Reporter | ||
Updated•9 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 1•9 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 129606:9aff2a52d88b user: Brian Hackett date: Mon Apr 22 20:22:30 2013 -0600 summary: Bug 863518 - Consider types added by loop body when unboxing OSR values, r=dvander. This iteration took 0.912 seconds to run.
Comment 3•9 years ago
|
||
Similar to bug 865192, in this case the stack depth at the current point for the loop header doesn't match those of other blocks because of the break from the loop. What's really intended here is to get the phi types at the start of the loop, not wherever the header happens to be; this patch changes things to get these types from the header's initial phis.
Attachment #744181 -
Flags: review?(dvander)
Attachment #744181 -
Flags: review?(dvander) → review+
Comment 5•9 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/0a050b75a9af
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in
before you can comment on or make changes to this bug.
Description
•