Closed Bug 478314 Opened 13 years ago Closed 13 years ago

TM: "Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)"

Categories

(Core :: JavaScript Engine, defect, P2)

x86
Linux
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: gkw, Assigned: mrbkap)

Details

(Keywords: assertion, testcase, verified1.9.1, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

for (var z = 0; z < 2; ++z) { switch(false & 1e-81) {} }

Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)

- TM-only, seems to work as expected.
- Nominating blocking1.9.1 because the verbose output shows something possibly related to js_DoubleToInt32 and switch blocks which was fixed yesterday, but this still occurs TM tip.

===

$ export TRACEMONKEY=verbose
$ ./js-dbg-tm-intelmac -j
js> for (var z = 0; z < 2; ++z) { switch(false & 1e-81) {} }
recording starting from typein:1@11
globalObj=0x9867000, shape=145
    start
    state = param 0 ecx
    0
    sp = ld state[0]
    4
    rp = ld state[4]
    12
    cx = ld state[12]
    8
    gp = ld state[8]
    16
    eos = ld state[16]
    20
    eor = ld state[20]
    40
    globalObj = ld state[40]
    ld1 = ld cx[0]
    eq1 = eq ld1, 0
    xf1: xf eq1 -> 0:11 sp+0 rp+0

00011:   1  false
00012:   1  double 1e-81
00015:   1  bitand
    sti sp[0] = 0
    #2F1E5AAC:F2156838 /* 1e-81 */
    stqi sp[8] = #0x2f1e5aac:#0xf2156838
    js_BooleanOrUndefinedToNumber1 = js_BooleanOrUndefinedToNumber ( cx 0 )

    js_DoubleToInt32_1 = js_DoubleToInt32 ( js_BooleanOrUndefinedToNumber1 )
Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)
Trace/breakpoint trap (core dumped)
Flags: blocking1.9.1?
Attached patch Proposed fixSplinter Review
This is the result of dmandelin and my talking this over for several minutes today. Andreas, could we change the text of this assertion to be something like, "constantly false guard detected?"
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #362297 - Flags: review?(gal)
Attachment #362297 - Flags: review?(gal) → review+
Comment on attachment 362297 [details] [diff] [review]
Proposed fix

Yeah, sure, the assert text is totally misleading.
Feel free to improve the assert text!
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
http://hg.mozilla.org/mozilla-central/rev/ac35c12230fa
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
Keywords: fixed1.9.1
missed recording this...

js1_5/Regress/regress-478314.js	
http://hg.mozilla.org/mozilla-central/rev/915b7595ef9f
Flags: in-testsuite? → in-testsuite+
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.