472049 - js1_5/Regress/regress-451322.js FAIL

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/8f8a4b924c32 caused js1_5/Regress/regress-451322.js to fail with a Assertion failed: "Unknown branch type in nPatchBranch": 0 (../nanojit/Nativei386.cpp:437).

This recently changed to a time out due to http://hg.mozilla.org/tracemonkey/rev/b369b9f805ba

Sorry it took so long to find the regressor(s). I broke my bisect script and couldn't reproduce the issue during bisection and only realized it this morning.

sensitive since bug 451322 is.

Comment 1

[Andreas Gal :gal]

Bob, can you try to extract a reliable test case (crash or assert)? The timeout is a bit difficult to test.

Comment 2

[Bob Clary [:bc] (inactive)]

Attachment: Sample on Mac OS X

gal, not sure how at the moment. perhaps this sample of a hung firefox session will help?

Comment 3

[Bob Clary [:bc] (inactive)]

or perhaps the assertion "Unknown branch type in nPatchBranch" which was either fixed or masked by the most recent checkin is the hint?

Comment 4

[Bob Clary [:bc] (inactive)]

got it in the debugger on windows with a deleted cx.

>	js.exe!js_FlushJITCache(JSContext * cx=0xdddddddd)  Line 4115 + 0x3 bytes	C++
 	js.exe!TraceRecorder::monitorRecording(JSOp op=JSOP_DIV)  Line 3835 + 0xb bytes	C++
 	js.exe!js_Interpret(JSContext * cx=0x00c6f760)  Line 2840 + 0x12 bytes	C++
 	js.exe!js_Execute(JSContext * cx=0x00c6f760, JSObject * chain=0x00db1000, JSScript * script=0x00c91d08, JSStackFrame * down=0x00000000, unsigned int flags=0, long * result=0x00000000)  Line 1564 + 0x9 bytes	C++
 	js.exe!JS_ExecuteScript(JSContext * cx=0x00c6f760, JSObject * obj=0x00db1000, JSScript * script=0x00c91d08, long * rval=0x00000000)  Line 5083 + 0x19 bytes	C++
 	js.exe!Process(JSContext * cx=0x00c6f760, JSObject * obj=0x00db1000, char * filename=0x00c6bdaa, int forceTTY=0)  Line 280 + 0x13 bytes	C++
 	js.exe!ProcessArgs(JSContext * cx=0x00c6f760, JSObject * obj=0x00db1000, char * * argv=0x00c6bcdc, int argc=14)  Line 556 + 0x19 bytes	C++
 	js.exe!main(int argc=14, char * * argv=0x00c6bcdc, char * * envp=0x00c66000)  Line 4090 + 0x15 bytes	C++
 	js.exe!__tmainCRTStartup()  Line 597 + 0x19 bytes	C

Comment 5

[Andreas Gal :gal]

Ok, the problem is that monitorRecording was made a method of TraceRecorder, but it deletes the recorder so we yank out the state from under ourselves. I will submit a patch shortly.

Comment 6

[Andreas Gal :gal]

Attachment: patch

Comment 7

[Andreas Gal :gal]

This is most definitively a blocker. Someone please mark it.

Comment 8

[Bob Clary [:bc] (inactive)]

patch works for me on windows. no crash.

Comment 9

[Brendan Eich [:brendan]]

Comment on attachment 355445 [details] [diff] [review]
patch

Sorry, I thought we could yank while jumping to the next level :-P.

/be

Comment 10

[Andreas Gal :gal]

Pushed to TM

http://hg.mozilla.org/tracemonkey/rev/ea9023d76bae

Comment 11

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/ea9023d76bae

Comment 12

[Bob Clary [:bc] (inactive)]

crashed verified fixed 1.9.1, 1.9.1-tm, 1.9.2

Comment 13

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/f67cbb089d00

Comment 14

[Bob Clary [:bc] (inactive)]

v 1.9.1.