477049 - TM: "Assertion failure: cx->bailExit, at ../jstracer.cpp"

Status: RESOLVED DUPLICATE of bug 473075

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: crash stack

eval("y = <z/>;");
for (var x = 0; x < 3; ++x) { "" in y; }

asserts TM debug at Assertion failure: cx->bailExit, at ../jstracer.cpp and crashes TM opt at 0x0000002c at LeaveTree. Nominating blocking1.9.1 because there are memory address-only locations in the opt crash stack.

TRACEMONKEY=verbose output:
/snip
--------------------------------------- end exit block 0x25f2b8
    st gp[720] = add1
    1
    loop
              mov 720(esi),ebx                ecx(state) ebx(add1) esi(gp)
        0x260ff3:
              jmp 0x0                        
    0x260ff8  [epilogue]                     
              mov esp,ebp                    
              pop ebp                        
              pop ebp                        
              pop ebx                        
              pop esi                        
              pop edi                        
              ret                            
fragment 0x25f004:
ENTRY: G0 G1 
recording completed at typein:2@11 via closeLoop
Looking for compat peer 2@11, from 0x25f004 (ip: 0x30e5db, hits=2)
checking vm types 0x25f004 (ip: 0x30e5db): global0=O/O global1=I/I 
entering trace at typein:2@11, native stack slots: 3 code: 0x260f50
global: object<0x29c1e0:XML> int<2> 
stack: 
Assertion failure: cx->bailExit, at ../jstracer.cpp:4628
Trace/BPT trap

Comment 1

[Jason Orendorff [:jorendorff]]

Taking...

Comment 2

[Jason Orendorff [:jorendorff]]

Oh, that.

Comment 3

[Bob Clary [:bc] (inactive)]

will handle the test in bug 473075.