466076 - TM: Assertion failed: "need a way to EOT now, since this is trace end" with |let|, |if|, anonymous function call

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

b.js:

for (let j = 0; j < 2; ++j) {
  if (j) {
    (function() {})();
  }
}


js -j ~/b.js

Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:934)


Bug is not triggered if I paste into the shell instead of using a file, or if I wrap it in a funciton.

Comment 1

[Carsten Book [:Tomcat]]

Note:

I was running into this assertion during my Topsite Test with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20081222 Firefox/3.1b3pre on http://www.championat.tv

I have created a reduced testcase and this cause a fatal assertion also when jit is off for chrome and only one for content (Jesse btw i'm not sure if i should file a new bug for this)

Stack:

Assertion failed: "need a way to EOT now, since this is trace end": 0 (/work/mozilla/builds/1.9.1/mozilla/js/src/nanojit/LIR.cpp:984)

Program received signal SIGTRAP, Trace/breakpoint trap.
NanoAssertFail () at /work/mozilla/builds/1.9.1/mozilla/js/src/nanojit/avmplus.cpp:54
54	    abort();
(gdb) bt
#0  NanoAssertFail () at /work/mozilla/builds/1.9.1/mozilla/js/src/nanojit/avmplus.cpp:54
#1  0x003ab500 in nanojit::ExprFilter::insGuard (this=0xfe27e90, v=nanojit::LIR_xt, c=0xeee7100, x=0xeee723c) at /work/mozilla/builds/1.9.1/mozilla/js/src/nanojit/LIR.cpp:984
#2  0x0033a891 in nanojit::LirWriter::insGuard (this=0xfe53410, v=nanojit::LIR_xt, c=0xeee7100, x=0xeee723c) at LIR.h:412
#3  0x00378d35 in TraceRecorder::guard (this=0xfe07eb0, expected=false, cond=0xeee7100, exit=0xeee723c) at /work/mozilla/builds/1.9.1/mozilla/js/src/jstracer.cpp:1977
#4  0x0038671c in TraceRecorder::guard (this=0xfe07eb0, expected=false, cond=0xeee7100, exitType=MISMATCH_EXIT) at /work/mozilla/builds/1.9.1/mozilla/js/src/jstracer.cpp:1985
#5  0x0038c05e in TraceRecorder::prop (this=0xfe07eb0, obj=0x149d6080, obj_ins=0xeee7088, slot=@0xbfff9498, v_ins=@0xbfff9494) at /work/mozilla/builds/1.9.1/mozilla/js/src/jstracer.cpp:6871
#6  0x0038c76a in TraceRecorder::getProp (this=0xfe07eb0, obj=0x149d6080, obj_ins=0xeee7088) at /work/mozilla/builds/1.9.1/mozilla/js/src/jstracer.cpp:7010
#7  0x0038c8f0 in TraceRecorder::getProp (this=0xfe07eb0, v=@0x14dfbac) at /work/mozilla/builds/1.9.1/mozilla/js/src/jstracer.cpp:7025
#8  0x0038c9e4 in TraceRecorder::record_JSOP_GETPROP (this=0xfe07eb0) at /work/mozilla/builds/1.9.1/mozilla/js/src/jstracer.cpp:6277
#9  0x002d39f1 in js_Interpret (cx=0x1348000) at jsopcode.tbl:170
#10 0x002e8e80 in js_Invoke (cx=0x1348000, argc=3, vp=0x14df954, flags=0) at jsinterp.cpp:1331
#11 0x0026d515 in array_extra (cx=0x1348000, mode=FOREACH, argc=3, vp=0x14df938) at /work/mozilla/builds/1.9.1/mozilla/js/src/jsarray.cpp:2878
#12 0x0026d734 in array_forEach (cx=0x1348000, argc=2, vp=0x14df938) at /work/mozilla/builds/1.9.1/mozilla/js/src/jsarray.cpp:2934
#13 0x002c0822 in js_Interpret (cx=0x1348000) at /work/mozilla/builds/1.9.1/mozilla/js/src/jsinterp.cpp:5119
#14 0x002e8e80 in js_Invoke (cx=0x1348000, argc=1, vp=0x14df820, flags=0) at jsinterp.cpp:1331
#15 0x00a48888 in nsXPCWrappedJSClass::CallMethod (this=0x13f6b2b0, wrapper=0xfe7b680, methodIndex=3, info=0x1194100, nativeParams=0xbfffcfc4) at /work/mozilla/builds/1.9.1/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1610
#16 0x00a402df in nsXPCWrappedJS::CallMethod (this=0xfe7b680, methodIndex=3, info=0x1194100, params=0xbfffcfc4) at /work/mozilla/builds/1.9.1/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:563
#17 0x00535078 in PrepareAndDispatch (self=0xfe7b6c0, methodIndex=3, args=0xbfffd0e4) at /work/mozilla/builds/1.9.1/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#18 0x005350d7 in nsXPTCStubBase::Stub3 (this=0xfe7b6c0) at xptcstubsdef.inc:1
#19 0x0b852e97 in nsEventListenerManager::HandleEventSubType (this=0xfe083b0, aListenerStruct=0xfe7dc10, aListener=0xfe7b6c0, aDOMEvent=0xfe0e0e0, aCurrentTarget=0x15eb800, aPhaseFlags=6) at /work/mozilla/builds/1.9.1/mozilla/content/events/src/nsEventListenerManager.cpp:1090
#20 0x0b854a28 in nsEventListenerManager::HandleEvent (this=0xfe083b0, aPresContext=0x13adc00, aEvent=0xfe60cd0, aDOMEvent=0xbfffd3c8, aCurrentTarget=0x15eb800, aFlags=6, aEventStatus=0xbfffd3cc) at /work/mozilla/builds/1.9.1/mozilla/content/events/src/nsEventListenerManager.cpp:1195
#21 0x0b8872b8 in nsEventTargetChainItem::HandleEvent (this=0x13ec420, aVisitor=@0xbfffd3c0, aFlags=6, aMayHaveNewListenerManagers=1) at /work/mozilla/builds/1.9.1/mozilla/content/events/src/nsEventDispatcher.cpp:236
#22 0x0b8874f8 in nsEventTargetChainItem::HandleEventTargetChain (this=0x13ec5a0, aVisitor=@0xbfffd3c0, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=1) at /work/mozilla/builds/1.9.1/mozilla/content/events/src/nsEventDispatcher.cpp:300
#23 0x0b887d4e in nsEventDispatcher::Dispatch (aTarget=0x15eb800, aPresContext=0x13adc00, aEvent=0xfe60cd0, aDOMEvent=0xfe0e0e0, aEventStatus=0xbfffd4a0, aCallback=0x0) at /work/mozilla/builds/1.9.1/mozilla/content/events/src/nsEventDispatcher.cpp:514
#24 0x0b88808c in nsEventDispatcher::DispatchDOMEvent (aTarget=0x15eb800, aEvent=0x0, aDOMEvent=0xfe0e0e0, aPresContext=0x13adc00, aEventStatus=0xbfffd4a0) at /work/mozilla/builds/1.9.1/mozilla/content/events/src/nsEventDispatcher.cpp:576
#25 0x0b7af284 in nsDocument::DispatchEvent (this=0x15eb800, aEvent=0xfe0e0e0, _retval=0xbfffd500) at /work/mozilla/builds/1.9.1/mozilla/content/base/src/nsDocument.cpp:6120
#26 0x0b77a6e3 in nsContentUtils::DispatchTrustedEvent (aDoc=0x15eb800, aTarget=0x15eb800, aEventName=@0xbfffd5b0, aCanBubble=1, aCancelable=1, aDefaultAction=0x0) at /work/mozilla/builds/1.9.1/mozilla/content/base/src/nsContentUtils.cpp:3085
#27 0x0b7af30e in nsDocument::DispatchContentLoadedEvents (this=0x15eb800) at /work/mozilla/builds/1.9.1/mozilla/content/base/src/nsDocument.cpp:3872
#28 0x0b7c185c in nsRunnableMethod<nsDocument>::Run (this=0xfe7f060) at nsThreadUtils.h:264
#29 0x00519f6a in nsThread::ProcessNextEvent (this=0x8155b0, mayWait=0, result=0xbfffd6e4) at /work/mozilla/builds/1.9.1/mozilla/xpcom/threads/nsThread.cpp:510
#30 0x004a40d2 in NS_ProcessPendingEvents_P (thread=0x8155b0, timeout=20) at nsThreadUtils.cpp:180
#31 0x098feddd in nsBaseAppShell::NativeEventCallback (this=0x836590) at /work/mozilla/builds/1.9.1/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#32 0x098b770c in nsAppShell::ProcessGeckoEvents (aInfo=0x836590) at /work/mozilla/builds/1.9.1/mozilla/widget/src/cocoa/nsAppShell.mm:374
#33 0x90a805f5 in CFRunLoopRunSpecific ()
#34 0x90a80cd8 in CFRunLoopRunInMode ()
#35 0x953212c0 in RunCurrentEventLoopInMode ()
#36 0x95321012 in ReceiveNextEventCommon ()
#37 0x95320f4d in BlockUntilNextEventMatchingListInMode ()
#38 0x92264d7d in _DPSNextEvent ()
#39 0x92264630 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#40 0x9225d66b in -[NSApplication run] ()
#41 0x098b5690 in nsAppShell::Run (this=0x836590) at /work/mozilla/builds/1.9.1/mozilla/widget/src/cocoa/nsAppShell.mm:693
#42 0x0a5cc5da in nsAppStartup::Run (this=0x850630) at /work/mozilla/builds/1.9.1/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
#43 0x000c229e in XRE_main (argc=1, argv=0xbfffec84, aAppData=0x80efe0) at /work/mozilla/builds/1.9.1/mozilla/toolkit/xre/nsAppRunner.cpp:3265
#44 0x000026e3 in main (argc=1, argv=0xbfffec84) at /work/mozilla/builds/1.9.1/mozilla/browser/app/nsBrowserApp.cpp:156
(gdb)

Comment 2

[Carsten Book [:Tomcat]]

Attachment: reduced testcase- Warning - cause fatal assertion on load

Comment 3

[Jesse Ruderman]

The original testcase in this bug WFM, so I think it would be best to file a new bug for http://www.championat.tv with your partially reduced testcase.

Btw, http://www.schmedley.com/ triggers this assertion failure too.

Comment 4

[Carsten Book [:Tomcat]]

(In reply to comment #3)
> The original testcase in this bug WFM, so I think it would be best to file a
> new bug for http://www.championat.tv with your partially reduced testcase.
> 
> Btw, http://www.schmedley.com/ triggers this assertion failure too.

thanks jesse, filed Bug 471212 now

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929