986717 - Fix typo in SnapshotIterator::allocationReadable

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Shu-yu Guo [:shu]]

Fix typo when decoding RValues from Snapshots

Comment 1

[Shu-yu Guo [:shu]]

Attachment: Fix typo in SnapshotIterator::allocationReadable

TYPE_REG layout has the known type in arg1 and the GPR in arg2.

Comment 2

[Shu-yu Guo [:shu]]

Comment on attachment 8395079 [details] [diff] [review]
Fix typo in SnapshotIterator::allocationReadable

Review of attachment 8395079 [details] [diff] [review]:
-----------------------------------------------------------------

r=h4writer over IRC

Comment 3

[Shu-yu Guo [:shu]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/6b7c6a1e963f

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I found a testcase that seems fixed by this:

$ ./js-dbg-64-ts-darwin-573ef29c7a9f --ion-parallel-compile=off --ion-eager testcase.js

function f() {
    arguments.callee.caller.arguments
    yield
}
function g(a) {
    try {
        for (x in f()) {}
    } catch (e) {}
}
g('')

Assertion failure: layoutFromMode(mode()).type1 == PAYLOAD_GPR, at jit/Snapshots.h

and it was caused by:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/a88353443251
user:        Nicolas B. Pierron
date:        Tue Mar 18 08:31:24 2014 -0700
summary:     Bug 962555 part 6 - IonMonkey: Simplify encoding & decoding of RValueAllocations. r=h4writer

Was this patch intended to fix the issue? (and perhaps the testcase can be landed?)

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack for assert in comment 4

Comment 6

[Shu-yu Guo [:shu]]

Yeah, looks like the same bug. Feel free to land that.

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/6b7c6a1e963f