Closed Bug 470061 Opened 13 years ago Closed 13 years ago
TM: "Assertion failure: cx->fp->regs->pc == f->ip && f->root == f"
Loading http://www.unitconversion.org/unit_converter/power.html on mozilla-central triggers: Assertion failure: cx->fp->regs->pc == f->ip && f->root == f, at /Users/jruderman/central/js/src/jstracer.cpp:2950
This seems to be a decompressor or de-obfuscator. It triggers the same assertion in a tracemonkey-branch-tip shell.
Awesome testcase. Reproduced in the shell.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Should be an easy fix.
Priority: -- → P1
I think this is about as much as I can reduce it. I pulled out a few constants and made them arguments to the function so that future constant-folding changes are less likely to change how the testcase is handled.
Looks like something is getting confused when walking out of a loop. Will investigate.
Assignee: general → danderson
This assertion is bogus. There's no guarantee that when resuming state from a loop exit (stable or unstable), we'll be resuming at f->ip. If a backwards branch is followed by a backwards goto, the exit's ip_adj will skip past the goto so nested trees don't attempt to record a break.
Attachment #353639 - Flags: review?(gal)
Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/8353e26475a8
merged to mc
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Checking in js1_5/Regress/regress-470061.js http://hg.mozilla.org/mozilla-central/rev/db39c91cd643
You need to log in before you can comment on or make changes to this bug.