Closed Bug 1207943 Opened 9 years ago Closed 9 years ago

Assertion failure: scratch != InvalidReg, at c:/Users/mozilla/debug-builds/mozilla-central/js/src/ji t/MacroAssembler.cpp:156

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla44
Tracking Status
firefox44 --- fixed

People

(Reporter: cbook, Assigned: jandem)

References

()

Details

(Keywords: assertion, intermittent-failure)

Attachments

(2 files)

Attached file bughunter crash stack
found via bughunter, reproduced on windows 7 debug builds

Steps to reproduce:
-> Load http://www.portalegeek.com/2014/10/scaricare-video-da-rai-replay-e-video.html

--> 

Assertion failure: scratch != InvalidReg, at c:/Users/mozilla/debug-builds/mozilla-central/js/src/ji
t/MacroAssembler.cpp:156
jonco: is this something for you ? seems this is somehow a regression
Flags: needinfo?(jcoppeard)
As per IRC discussion, I didn't touch this code so clearing needinfo.
Flags: needinfo?(jcoppeard)
Bug 1207210 probably exposed this, will try to repro.
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
The assertion failure happens when we have MTypeBarrier with MIRType_ObjectOrNull, getObjectCount() == 0 and barrierKind == TypeSet.

In that case we don't request a temp register so we can call guardObjectType with scratch == InvalidReg. This patch fixes the assert.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8665915 - Flags: review?(bhackett1024)
Attachment #8665915 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/abcc2798634a
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla44
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: