1077340 - Assertion failure: CountArgSlots(script, fun) < SNAPSHOT_MAX_NARGS + 4, at jit/Recover.cpp:114

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 2ae57957e4bb (run with --fuzzing-safe --thread-count=2 --ion-offthread-compile=off):


Array.buildPar(500, (function(
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a, a,
a, a, a, a, a, a, a, a, a
) {}));

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
Due to skipped revisions, the first bad revision could be any of:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a0dd5a83ba36
user:        Jan de Mooij
date:        Thu Jul 24 11:56:43 2014 +0200
summary:     Bug 1031529 part 2 - Remove JS_THREADSAFE #ifdefs everywhere. r=bhackett

changeset:   https://hg.mozilla.org/mozilla-central/rev/6426fef52f51
user:        Jan de Mooij
date:        Thu Jul 24 11:56:45 2014 +0200
summary:     Bug 1031529 part 3 - Step defining JS_THREADSAFE, remove --disable-threadsafe. r=glandium

This iteration took 1.259 seconds to run.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Awaiting on me to try and get a better bisect.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Clearing needinfo? for now.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 206205dd8bd1).

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

=== Tinderbox Build Bisection Results by autoBisect ===

The "bad" changeset has the timestamp "20150106222023" and the hash "46bd519c8e2b".
The "good" changeset has the timestamp "20150106230727" and the hash "13869ca774bb".

Likely fix window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=46bd519c8e2b&tochange=13869ca774bb

PJS has been disabled as per bug 1117764, marking WONTFIX as per other similar bugs.