TM: Assertion failed: "need a way to EOT now, since this is trace end": 0 (c:/moz/mozilla-central/js/src/nanojit/LIR.cpp:944)

RESOLVED FIXED in mozilla1.9.1

Status

()

Core
JavaScript Engine
RESOLVED FIXED
10 years ago
9 years ago

People

(Reporter: Gavin, Unassigned)

Tracking

({assertion, testcase})

Trunk
mozilla1.9.1
x86
Windows Vista
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment)

Loading http://www.newsweek.com/id/167905/page/3 in a current tip (c44cafd3d7c8) m-c debug build triggers:

http://hg.mozilla.org/mozilla-central/annotate/c44cafd3d7c8/js/src/nanojit/LIR.cpp#l944

Stack:
ntdll!DbgBreakPoint+0x1
js3250!nanojit::ExprFilter::insGuard+0x91 [nanojit\lir.cpp @ 944]
js3250!nanojit::LirWriter::insGuard+0x28 [nanojit\lir.h @ 558]
js3250!TraceRecorder::guard+0x32 [jstracer.cpp @ 1895]
js3250!TraceRecorder::guard+0x24 [jstracer.cpp @ 1903]
js3250!TraceRecorder::getThis+0x6d [jstracer.cpp @ 4096]
js3250!TraceRecorder::record_JSOP_THIS+0x15 [jstracer.cpp @ 5711]
js3250!js_Interpret+0x18e5f [jsopcode.tbl @ 173]
js3250!js_Execute+0x2dd [jsinterp.cpp @ 1550]
js3250!JS_EvaluateUCScriptForPrincipals+0xe1 [jsapi.cpp @ 5180]
gklayout!nsJSContext::EvaluateString+0x2ba [nsjsenvironment.cpp @ 1586]

Comment 1

10 years ago
Bug 463783 shows another way to trigger this assertion.
The assertion doesn't show at the given newsweek URL, thus WFM on 10.5.5 with a self-compiled Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b2pre) Gecko/20081108 Minefield/3.1b2pre

Build is compiled after the most-recent m-c/tm merge.
Created attachment 347044 [details]
partially reduced testcase

Comment 4

10 years ago
That's the same ad script that triggered this assertion in bug 462989!

Comment 5

10 years ago
WFM.  Gavin, I think you were using a build from before last night's tm->mc merge :(
Yeah, I was. I can't reproduce with a post-merge build, hg bisect says this was fixed by bug 450833.
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.1
Depends on: 450833
Keywords: testcase

Comment 7

10 years ago
test landed http://hg.mozilla.org/mozilla-central/rev/f5de446f55ce and cvs
Flags: in-testsuite+
Flags: in-litmus-

Comment 8

9 years ago
fix summary to not include string 'Assertion fail'
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-463782.js,v  <--  regress-463782.js
new revision: 1.2; previous revision: 1.1
You need to log in before you can comment on or make changes to this bug.