Closed
Bug 669950
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: index < stackDepth_, at MIR.h:843
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: dvander)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
|
(deleted),
patch
|
sstangl
:
review+
|
Details | Diff | Splinter Review |
--
(function () {
var x = true ? 1 : 2;
})();
--
Asserts at revision 938e06c2ee03:
Assertion failure: index < stackDepth_, at MIR.h:843
|
||
Updated•13 years ago
|
|
Assignee | |
Comment 1•13 years ago
|
||
Whoops. We were taking a block's entry snapshot before we knew its stack depth.
|
|
Assignee | |
Comment 2•13 years ago
|
||
(Ignore that breakpoint.)
|
||
Updated•13 years ago
|
|
||
Comment 3•13 years ago
|
||
Comment on attachment 551276 [details] [diff] [review]
fix
Review of attachment 551276 [details] [diff] [review]:
-----------------------------------------------------------------
::: js/src/ion/MIRGraph.cpp
@@ +448,5 @@
>
> bool
> MBasicBlock::addPredecessor(MBasicBlock *pred)
> {
> + JS_ASSERT(predecessors_.length() > 0);
Unused control flow elimination uses addPredecessor() to update predecessor information, so it may actually be the case that a block temporarily has no predecessors. No changes needed in this patch, though.
Attachment #551276 -
Flags: review?(sstangl) → review+
|
|
Assignee | |
Comment 4•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•