Closed
Bug 1037657
Opened 10 years ago
Closed 10 years ago
Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Invalid BailoutKind), at vm/ForkJoin.cpp
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla33
People
(Reporter: gkw, Assigned: shu)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:bisectfix])
Attachments
(2 files)
3.19 KB,
text/plain
|
Details | |
2.29 KB,
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
x = Array.buildPar(7, Symbol); Array.prototype.push.call(x, 2); x.mapPar(function(){}, 1) asserts js debug shell on m-c changeset 84bd8d9f4256 with --ion-eager --ion-offthread-compile=off at Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Invalid BailoutKind), at vm/ForkJoin.cpp My configure flags are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options> === Tinderbox Build Bisection Results by autoBisect === The "good" changeset has the timestamp "20140626231828" and the hash "8f83a0ab5060". The "bad" changeset has the timestamp "20140627003628" and the hash "72a548ec4f56". Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8f83a0ab5060&tochange=72a548ec4f56 Shu-yu, is bug 1028331 a likely regressor, or did it just expose it?
Flags: needinfo?(shu)
Assignee | ||
Comment 1•10 years ago
|
||
Caused by bug 645416 part 6, which added a new BailoutKind along with the JIT machinery for Symbols.
Flags: needinfo?(shu)
Assignee | ||
Comment 2•10 years ago
|
||
Attachment #8454755 -
Flags: review?(jorendorff)
Assignee | ||
Updated•10 years ago
|
Assignee: nobody → shu
Status: NEW → ASSIGNED
Reporter | ||
Updated•10 years ago
|
Updated•10 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Comment 3•10 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision b0701d069bf9).
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Comment 4•10 years ago
|
||
Comment on attachment 8454755 [details] [diff] [review] Handle Bailout_NonSymbolInput in PJS bailout warnings. Review of attachment 8454755 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/vm/ForkJoin.cpp @@ +1114,5 @@ > case Bailout_NonStringInput: > case Bailout_NonStringInputInvalidate: > return "can't unbox: expected string"; > + case Bailout_NonSymbolInput: > + return "can't unbox: expected symbol"; Darn it. Sorry. :(
Attachment #8454755 -
Flags: review?(jorendorff) → review+
Assignee | ||
Comment 5•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/734231b3e382
Comment 6•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/734231b3e382
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in
before you can comment on or make changes to this bug.
Description
•