693840 - Assertion failure: !ic.pools[index], at /tmp/js/mozilla-central-ed4026a18fdb/js/src/methodjit/MonoIC.cpp:706

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Anthony Catel [:paraboul]]

Attachment: crash.js

User Agent: Mozilla/5.0 (X11; Linux i686; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
Build ID: 20110928134238

Steps to reproduce:

Run attached file with -m -j using valgrind (./configure --enable-debug --enable-valgrind).

gcc version 4.4.5


Actual results:

Assertion failure: !ic.pools[index], at /tmp/js/mozilla-central-ed4026a18fdb/js/src/methodjit/MonoIC.cpp:706

Comment 1

[Anthony Catel [:paraboul]]

(same result with 1.8.5 build)

Comment 2

[David Mandelin [:dmandelin]]

I can't repro this in 64-bit builds on OS 10.6. 

What actually triggers the assert? Is it building with --enable-valgrind, or is it running under valgrind?

Comment 3

[Anthony Catel [:paraboul]]

I also run a 64bit build.

It only happens when running with valgrind (valgrind ./js -m -j).
It's indeed built with --enable-valgrind.

Comment 4

[Anthony Catel [:paraboul]]

$ valgrind --version
valgrind-3.6.0.SVN-Debian

Comment 5

[Nicolas B. Pierron [:nbp]]

tl;dr: use valgrind --smc-check=all-non-file

I just had the same issue, and realize that I forgot to add --smc-check=all-non-file which is necessary to tell valgrind that some code is generated and that it should reload his buffer when the memory is written into.  In such case this happen in the inline cache of JM because valgrind still run the non patched code.