Closed Bug 470187 Opened 16 years ago Closed 16 years ago

TM: "Assertion failure: entry->kpc == (jsbytecode*) atoms[index]" with valueOf, regexp

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.9.1b3

People

(Reporter: jruderman, Assigned: brendan)

Details

(Keywords: assertion, testcase, verified1.9.1, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

fix
2.81 KB, patch
jorendorff
: review+
Details | Diff | Splinter Review 
for (var j=0;j<3;++j) ({valueOf: function(){return 2}}) - /x/;

Assertion failure: entry->kpc == (jsbytecode*) atoms[index], at ../jstracer.cpp:5026
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b3
js> for (var j=0;j<3;++j) ({valueOf: function(){return 2}}) - [];
Assertion failure: ATOM_IS_STRING(atom), at ../jstracer.cpp:7010
WFM on tm tip -- please verify or reopen if I'm missing something. Suspect this was fixed by imacros.

/be
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Both assertions still happen, but only when the testcases are fed to ./js as files (rather than pastes into the shell).
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
I can't repro:

Yoyodyne:src brendaneich$ cat /tmp/fooey.js
for (var j=0;j<3;++j) ({valueOf: function(){return 2}}) - /x/;
Yoyodyne:src brendaneich$ ./Darwin_DBG.OBJ/js !$
./Darwin_DBG.OBJ/js /tmp/fooey.js
Yoyodyne:src brendaneich$ cat /tmp/fooey2.js
for (var j=0;j<3;++j) ({valueOf: function(){return 2}}) - [];
Yoyodyne:src brendaneich$ ./Darwin_DBG.OBJ/js !$
./Darwin_DBG.OBJ/js /tmp/fooey2.js

What's the secret ingredient?

/be
Argh, I was confusing this bug with bug 453955 insofar as being independent of -j -- but of course the assertions that are botching are in jstracer.cpp. Duh!

/be
Status: REOPENED → ASSIGNED
Summary: "Assertion failure: entry->kpc == (jsbytecode*) atoms[index]" with valueOf, regexp → TM: "Assertion failure: entry->kpc == (jsbytecode*) atoms[index]" with valueOf, regexp
Attached patch fix — — Splinter Review 
Fix (in final hunk) plus cleanup that avoids repeating the atoms = fp->imacpc ? ... : ...; three-liner all over creation.

/be
Attachment #358352 - Flags: review?(jorendorff)
This should block, we are failing to restore the correct atoms pointer in the recorder when tracing out of a trace-inlined function call. Manifold disaster ensues.

/be
Flags: blocking1.9.1?
Flags: blocking1.9.1? → blocking1.9.1+
Comment on attachment 358352 [details] [diff] [review]
fix

Looks good.
Attachment #358352 - Flags: review?(jorendorff) → review+
Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/f53361213469

/be
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/bf99bd959cfb
Status: ASSIGNED → RESOLVED
Closed: 16 years ago → 16 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey → fixed-in-tracemonkey [needs 191 landing]
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/103adc44c092
Keywords: fixed1.9.1
Whiteboard: fixed-in-tracemonkey [needs 191 landing] → fixed-in-tracemonkey
js1_5/Regress/regress-470187-01.js
js1_5/Regress/regress-470187-02.js

v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: