Closed
Bug 763039
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: *ptr == 0xE9, at ../ion/shared/Assembler-x86-shared.h:1164
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: sstangl)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
|
(deleted),
text/javascript
|
Details | |
|
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The attached testcase asserts on ionmonkey revision 5cfb73435e06 (run with --ion -n -m --ion-eager).
|
Assignee | |
Updated•12 years ago
|
Assignee: general → sstangl
|
|
Assignee | |
Comment 1•12 years ago
|
||
IGC started after the toggledJump was emitted. Fix is to always emit barriers as disabled, then enable at the very end of compilation. Further GC action will then correctly toggle the script's barriers, since it will be reachable from a JSScript.
Attachment #631538 -
Flags: review?(dvander)
|
||
Updated•12 years ago
|
Attachment #631538 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 3•12 years ago
|
||
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Comment 4•12 years ago
|
||
Forgot to update a header for ARM.
http://hg.mozilla.org/projects/ionmonkey/rev/ea534d594d01
|
Reporter | |
Comment 5•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•