463782 - TM: Assertion failed: "need a way to EOT now, since this is trace end": 0 (c:/moz/mozilla-central/js/src/nanojit/LIR.cpp:944)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

Loading http://www.newsweek.com/id/167905/page/3 in a current tip (c44cafd3d7c8) m-c debug build triggers:

http://hg.mozilla.org/mozilla-central/annotate/c44cafd3d7c8/js/src/nanojit/LIR.cpp#l944

Stack:
ntdll!DbgBreakPoint+0x1
js3250!nanojit::ExprFilter::insGuard+0x91 [nanojit\lir.cpp @ 944]
js3250!nanojit::LirWriter::insGuard+0x28 [nanojit\lir.h @ 558]
js3250!TraceRecorder::guard+0x32 [jstracer.cpp @ 1895]
js3250!TraceRecorder::guard+0x24 [jstracer.cpp @ 1903]
js3250!TraceRecorder::getThis+0x6d [jstracer.cpp @ 4096]
js3250!TraceRecorder::record_JSOP_THIS+0x15 [jstracer.cpp @ 5711]
js3250!js_Interpret+0x18e5f [jsopcode.tbl @ 173]
js3250!js_Execute+0x2dd [jsinterp.cpp @ 1550]
js3250!JS_EvaluateUCScriptForPrincipals+0xe1 [jsapi.cpp @ 5180]
gklayout!nsJSContext::EvaluateString+0x2ba [nsjsenvironment.cpp @ 1586]

Comment 1

[Jesse Ruderman]

Bug 463783 shows another way to trigger this assertion.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The assertion doesn't show at the given newsweek URL, thus WFM on 10.5.5 with a self-compiled Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b2pre) Gecko/20081108 Minefield/3.1b2pre

Build is compiled after the most-recent m-c/tm merge.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Attachment: partially reduced testcase

Comment 4

[Jesse Ruderman]

That's the same ad script that triggered this assertion in bug 462989!

Comment 5

[Jesse Ruderman]

WFM.  Gavin, I think you were using a build from before last night's tm->mc merge :(

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Yeah, I was. I can't reproduce with a post-merge build, hg bisect says this was fixed by bug 450833.

Comment 7

[Bob Clary [:bc] (inactive)]

test landed http://hg.mozilla.org/mozilla-central/rev/f5de446f55ce and cvs

Comment 8

[Bob Clary [:bc] (inactive)]

fix summary to not include string 'Assertion fail'
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-463782.js,v  <--  regress-463782.js
new revision: 1.2; previous revision: 1.1