707384 - TI: "Assertion failure: getCode(offset).loop," with trap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack with dis() information

function f() {
    do {
        return
    } while (e)
}
dis(f)
trap(f, 1, '')
f()

asserts js debug shell on m-c changeset 6180c68bffbf with -m, -a, -n and -d at Assertion failure: getCode(offset).loop,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81128:d32ccb2b8a05
user:        Brian Hackett
date:        Thu Dec 01 15:13:51 2011 -0800
summary:     Remove JSOP_NOTRACE, rename JSOP_TRACE -> JSOP_LOOPHEAD, bug 706611. r=dvander

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

One of the test changes in bug 706611 was incorrect, the compiler needs to check that a loop head has a reachable backedge before compiling it as a loop.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7769ec8647b9

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7769ec8647b9

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug707384.js.