1142993 - Assertion failure: !has(tmp), at /mozilla/builds/nightly/mozilla/js/src/jit/RegisterSets.h:392

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Found via Bughunter and reproduced on a Mac OS 10.9 Trunk Build based on mozilla-central tip 

Note: on Windows Bughunter reports this as medium exploitable

Steps to reproduce:

-> Load https://vimeo.com/11892211
--> Assertion failure: !has(tmp), at /mozilla/builds/nightly/mozilla/js/src/jit/RegisterSets.h:392

Comment 1

[Carsten Book [:Tomcat]]

Attachment: mac stack

Comment 2

[Carsten Book [:Tomcat]]

Attachment: windows stack

Comment 3

[Jan de Mooij [:jandem]]

This seems to be a regression from bug 1140737, but I don't really understand why we're asserting. Maybe a register aliasing issue. The code looks fine to me though...

bz, do you want to take a look? Else I can debug it.

Comment 4

[Nicolas B. Pierron [:nbp]]

Can this issue be reproduced with Bug 1143011.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Based on comment 3 I will mark 38 as unaffected. It sounds like a regression in 39.

Comment 6

[Nicolas B. Pierron [:nbp]]

Do we still have new reports since Bug 1143011 landed on mozilla-central?

Comment 7

[Carsten Book [:Tomcat]]

(In reply to Nicolas B. Pierron [:nbp] from comment #6)
> Do we still have new reports since Bug 1143011 landed on mozilla-central?

yeah does not crash anymore on my testcase \o/

Comment 8

[Nicolas B. Pierron [:nbp]]

(In reply to Carsten Book [:Tomcat] from comment #7)
> (In reply to Nicolas B. Pierron [:nbp] from comment #6)
> > Do we still have new reports since Bug 1143011 landed on mozilla-central?
> 
> yeah does not crash anymore on my testcase \o/

Good :)

The patch got backout from aurora (Bug 1149377), so it might be broken on aurora.
I waiting for tens of PGO build results to find where PGO is failing.

Comment 9

[Jan de Mooij [:jandem]]

Clearing needinfo, bug 1143011 should have fixed this.

Comment 10

[Carsten Book [:Tomcat]]

yes marking fixed for firefox 40 by bug 1143011 - for Fx39 this need be landed on aurora where its currently backed out