Closed
Bug 894782
Opened 12 years ago
Closed 12 years ago
Assertion failure: found, at ion/CodeGenerator.cpp
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla25
People
(Reporter: gkw, Assigned: shu)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:])
Attachments
(2 files)
9.34 KB,
text/plain
|
Details | |
4.90 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
print(ParallelArray())
String(Object.create(ParallelArray(8077, function() {})))
asserts js debug shell on m-c changeset 582ffcd0459a with --baseline-eager at Assertion failure: found, at ion/CodeGenerator.cpp
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:]
Comment 1•12 years ago
|
||
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
![]() |
Reporter | |
Comment 2•12 years ago
|
||
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: http://hg.mozilla.org/mozilla-central/rev/0960402d8145
user: Jan de Mooij
date: Tue Jul 16 21:34:02 2013 +0200
summary: Bug 852421 - Remove MarkTypeObjectUnknownProperties call from Object.create. r=bhackett
Blocks: 852421
Comment 3•12 years ago
|
||
Gary, do you also have tests without ParallelArray in it? I think this is a pre-existing ParallelArray TI issue.
Updated•12 years ago
|
Flags: needinfo?(gary)
Assignee | ||
Comment 4•12 years ago
|
||
Summary of discussion over IRC:
This is a bug in the poly inline dispatch in how callsite clones are dealt with. Callsite clones are supposed to be a "just-in-time" replacement, with the original function being used for everything user visible (like guarding against) until we need to enter the function, when the clone is swapped in.
The entries in InlinePropertyTable only seem to be used for comparisons for guarding against the set of functions to be inlined. So we should be using the originals, but currently we are using the clones.
This only manifests with ParallelArrays because nothing else uses callsite cloning to get extra precision yet.
Comment 5•12 years ago
|
||
Comment on attachment 777040 [details] [diff] [review]
fix
Review of attachment 777040 [details] [diff] [review]:
-----------------------------------------------------------------
Thanks for fixing this so quickly.
Please also add the testcase, r=me with that.
Attachment #777040 -
Flags: review?(jdemooij) → review+
Comment 6•12 years ago
|
||
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in
before you can comment on or make changes to this bug.
Description
•