Closed
Bug 737300
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: defdata->classPrev == __null, at ion/ValueNumbering.cpp:464
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
(deleted),
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision b5b6e6aebb36 (run with --ion -n -m --ion-eager):
function loopy(p0)
{
var r3 = p0;
var r4 = p0;
var r6 = p0;
var r7 = p0;
while (r2) {
while (r2) {
r5 = r6 & r1;
r3 = r4 & r3;
r2 = r7;
}
}
}
loopy(0);
|
||
Comment 2•13 years ago
|
||
Comment on attachment 608207 [details] [diff] [review]
/home/mrosenberg/patches/gvn_fix-r2.patch
Review of attachment 608207 [details] [diff] [review]:
-----------------------------------------------------------------
Good catch. The patch has some unrelated comment changes, were these intended?
::: js/src/ion/ValueNumbering.h
@@ +149,4 @@
> if (classNext)
> classNext->valueNumberData()->classPrev = classPrev;
> if (classPrev)
> classPrev->valueNumberData()->classPrev = classNext;
Pre-existing, but I think the last line should be:
classPrev->valueNumberData()->classNext = classNext;
Attachment #608207 -
Flags: review?(jdemooij) → review+
|
||
Comment 3•13 years ago
|
||
landed: http://hg.mozilla.org/projects/ionmonkey/rev/15da4376607b
And yes, those comments were unrelated, they were pushed back into the previous patch.
|
Reporter | |
Comment 4•13 years ago
|
||
Fixed per comment 3.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
|
Reporter | |
Comment 5•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•