450304 - TM: asserts logging into gmail

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: trace and gdb dump

assertion is in nanojit, somewhere we're generating an feq(i2f, imm(1)) which is invalid

Comment 1

[Andreas Gal :gal]

Committed fix, please re-test and close if fixed.

http://hg.mozilla.org/index.cgi/tracemonkey/rev/cdda9caf1fb2

Comment 2

[Andreas Gal :gal]

Whats the status of this bug?

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: trace and gdb dump

Current tip hard crashes when logging into gmail.  Keeping the debugging session open on my laptop in MV.

Comment 4

[Brendan Eich [:brendan]]

Fixed, at least any for-in badness, by:

http://hg.mozilla.org/tracemonkey/index.cgi/rev/b7199324e019

David, can you mark this bug FIXED if gmail works for sure with TM tip?

/be

Comment 5

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/index.cgi/rev/b7199324e019

breaks browser startup (n < nfixed).

Comment 6

[Andreas Gal :gal]

(Logging into gmail worked because after rm -rf .mozilla the JIT was defaulting to off)

Comment 7

[Brendan Eich [:brendan]]

The n < cx->fp->script->nfixed assert in TraceRecorder::varval is wrong. The code is using let in a for each in loop that was recorded, but the enclosing JSOP_ENTERBLOCK was not seen.

Fixing the assert to use cx->fp->script->nslots instead is easy, but then we get another crash, this time due to test_property_cache being buggy. I'm going to fix that and use this bug to see what's next ;-).

/be

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

Awesome, gmail seems to work with tip now.