Assertion failure: x->oprnd2() == lirbuf->sp || x->oprnd2() == gp_ins - js1_6/extensions/regress-455464-03.js browser only

VERIFIED FIXED

Status

()

Core
JavaScript Engine
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: bc, Assigned: graydon)

Tracking

(4 keywords)

Trunk
x86
Linux
assertion, regression, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(URL)

(Reporter)

Description

9 years ago
1.9.2, linux, browser only, non jit (at least)

<http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=js1_6%2Fextensions%2Fregress-455464-03.js;language=type;text/javascript>

Assertion failure: x->oprnd2() == lirbuf->sp || x->oprnd2() == gp_ins, at jstracer.cpp:1878
Flags: in-testsuite+
non-jit, really?  I wonder what we're doing emitting LIR if we've got the JIT disabled...
(Reporter)

Comment 2

9 years ago
no, not really. :-( I forgot this test includes direct calls to turn jit on.
(Reporter)

Comment 3

9 years ago
now occurs on 1.9.1 and 1.9.1-tracemonkey. regressed by bug 479442
Blocks: 479442
Flags: blocking1.9.1?

Updated

9 years ago
Flags: blocking1.9.1? → blocking1.9.1+
(Reporter)

Comment 4

9 years ago
http://hg.mozilla.org/mozilla-central/rev/3d0e0bc6a8c4 was the regressor and confirmed by bisecting both on tracemonkey and mozilla-central.

Comment 5

9 years ago
This is the code in question.

a=b=c=d=0; this.__defineGetter__('g', gc); for each (y in this);

Comment 6

9 years ago
WFM with TM tip. Also works in the shell.
(Reporter)

Comment 7

9 years ago
I can still reproduce this on tracemonkey in mac and linux but not in 1.9.1 or 1.9.2 it appears. I'll bisect and see what changed it.

If you are trying to to reproduce, you may need to enable

user_pref("signed.applets.codebase_principal_support", true);

and grant bclary.com permission to modify prefs. several tests only assert if jit is dynamically switched on just prior to the test code.
(Assignee)

Updated

9 years ago
Assignee: general → graydon
(Reporter)

Comment 8

9 years ago
Ok, the last time I saw this was around 3/10. Bisecting now for the fixor.
(Reporter)

Updated

9 years ago
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Updated

9 years ago
Keywords: fixed1.9.1
(Reporter)

Comment 10

9 years ago
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.