Closed
Bug 890414
Opened 11 years ago
Closed 11 years ago
Assertion failure: safepoint->hasSlotsOrElementsPointer(alloc), at ion/RegisterAllocator.cpp
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla25
People
(Reporter: gkw, Assigned: jandem)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker])
Attachments
(2 files)
|
(deleted),
text/plain
|
Details | |
|
(deleted),
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
function f() {
for (x = 1; x < 9; x++) {}
}
new f
asserts js debug shell on m-c changeset bc99f68f8946 with --ion-eager --ion-regalloc=backtracking at Assertion failure: safepoint->hasSlotsOrElementsPointer(alloc), at ion/RegisterAllocator.cpp
This blocks fuzzing with --ion-regalloc=backtracking, as it is blowing up jsfunfuzz.
|
Reporter | |
Comment 1•11 years ago
|
||
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: http://hg.mozilla.org/mozilla-central/rev/9a62d56be0bc
user: Jan de Mooij
date: Wed Jul 03 20:27:39 2013 +0200
summary: Bug 888872 - Keep track of slots/elements pointers stored in Ion frames for generational GC. r=dvander,terrence
Blocks: 888872
Flags: needinfo?(jdemooij)
|
|
Reporter | |
Comment 2•11 years ago
|
||
Tested on m-c tip rev 17fe59f6c54a.
|
Assignee | |
Comment 3•11 years ago
|
||
Ah, the backtracking allocator no longer uses the regalloc verifier to fill safepoints so bug 888872 broke it.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #771983 -
Flags: review?(bhackett1024)
Flags: needinfo?(jdemooij)
|
||
Updated•11 years ago
|
Attachment #771983 -
Flags: review?(bhackett1024) → review+
|
|
Assignee | |
Comment 4•11 years ago
|
||
|
||
Comment 5•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/8e1f9400edde
Should this have a test?
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in
before you can comment on or make changes to this bug.
Description
•