470061 - TM: "Assertion failure: cx->fp->regs->pc == f->ip && f->root == f"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Loading http://www.unitconversion.org/unit_converter/power.html on mozilla-central triggers:

Assertion failure: cx->fp->regs->pc == f->ip && f->root == f, at /Users/jruderman/central/js/src/jstracer.cpp:2950

Comment 1

[Jesse Ruderman]

Attachment: extracted script

This seems to be a decompressor or de-obfuscator.  It triggers the same assertion in a tracemonkey-branch-tip shell.

Comment 2

[Jesse Ruderman]

Attachment: reduced a bit

Comment 3

[Andreas Gal :gal]

Awesome testcase. Reproduced in the shell.

Comment 4

[Andreas Gal :gal]

Should be an easy fix.

Comment 5

[Jesse Ruderman]

Attachment: reduced

I think this is about as much as I can reduce it.  I pulled out a few constants and made them arguments to the function so that future constant-folding changes are less likely to change how the testcase is handled.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Looks like something is getting confused when walking out of a loop.  Will investigate.

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix bogus assertion

This assertion is bogus.  There's no guarantee that when resuming state from a loop exit (stable or unstable), we'll be resuming at f->ip.  If a backwards branch is followed by a backwards goto, the exit's ip_adj will skip past the goto so nested trees don't attempt to record a break.

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/8353e26475a8

Comment 9

[Robert Sayre]

merged to mc

Comment 10

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d4755cd46256

Comment 11

[Bob Clary [:bc] (inactive)]

Checking in js1_5/Regress/regress-470061.js
http://hg.mozilla.org/mozilla-central/rev/db39c91cd643

Comment 12

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2