Closed
Bug 679581
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: mode() == TYPED_REG && knownType() != JSVAL_TYPE_DOUBLE, at Snapshots.h:182 with LSRA
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: adrake, Assigned: dvander)
References
(Blocks 1 open bug)
Details
Attachments
(2 files)
|
(deleted),
application/javascript
|
Details | |
|
(deleted),
patch
|
sstangl
:
review+
|
Details | Diff | Splinter Review |
Attached test case dies during bailout on ionmonkey tip, x86 debug builds with lsra enabled.
|
Assignee | |
Comment 1•13 years ago
|
||
Simple bug in reading doubles off the stack when bailing out. I also added some spew to help debug things like this:
[Snapshots] Encoding snapshot 0x85686e0 (nfixed 5) (exprStack 0)
[Snapshots] slot 0: value (t=144, d=140)
[Snapshots] slot 1: int32 (stack 148)
[Snapshots] slot 2: undefined
[Snapshots] slot 3: value (t=124, d=edi)
[Snapshots] slot 4: double (stack 112)
[Snapshots] total size: 23 bytes
|
||
Updated•13 years ago
|
Attachment #554548 -
Flags: review?(sstangl) → review+
|
|
Assignee | |
Comment 2•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•