Closed Bug 1207943 Opened 10 years ago Closed 10 years ago

Assertion failure: scratch != InvalidReg, at c:/Users/mozilla/debug-builds/mozilla-central/js/src/ji t/MacroAssembler.cpp:156

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla44
Tracking Status
firefox44 --- fixed

People

(Reporter: cbook, Assigned: jandem)

References

()

Details

(Keywords: assertion, intermittent-failure)

Attachments

(2 files)

Attached file bughunter crash stack —
found via bughunter, reproduced on windows 7 debug builds Steps to reproduce: -> Load http://www.portalegeek.com/2014/10/scaricare-video-da-rai-replay-e-video.html --> Assertion failure: scratch != InvalidReg, at c:/Users/mozilla/debug-builds/mozilla-central/js/src/ji t/MacroAssembler.cpp:156
jonco: is this something for you ? seems this is somehow a regression
Flags: needinfo?(jcoppeard)
As per IRC discussion, I didn't touch this code so clearing needinfo.
Flags: needinfo?(jcoppeard)
Bug 1207210 probably exposed this, will try to repro.
Flags: needinfo?(jdemooij)
Attached patch Patch — — Splinter Review
The assertion failure happens when we have MTypeBarrier with MIRType_ObjectOrNull, getObjectCount() == 0 and barrierKind == TypeSet. In that case we don't request a temp register so we can call guardObjectType with scratch == InvalidReg. This patch fixes the assert.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8665915 - Flags: review?(bhackett1024)
Attachment #8665915 - Flags: review?(bhackett1024) → review+
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla44
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: