Closed Bug 519534 Opened 12 years ago Closed 12 years ago

Assertion failure: regs->pc == innermost->pc, at js/src/jstracer.cpp:6281

Categories

(Core :: JavaScript Engine, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla1.9.3a1
Tracking Status
status1.9.2 --- beta2-fixed

People

(Reporter: mats, Assigned: dvander)

References

Details

(Keywords: assertion, Whiteboard: fixed-in-tracemonkey)

Attachments

(3 files)

Attached file Full stack trace
Assertion failure: regs->pc == innermost->pc, at js/src/jstracer.cpp:6281

My Firefox trunk debug build on x86_64 Linux crashes about 90% of the
time on startup.  If it survives the first few seconds it usually
crashes within minutes.

It looks like this assertion was added in bug 518492,
and has now been merged to mozilla-central?

I have attached "bt full" from gdb, let me know if you need anything else.
This specific trigger is bogus, I need to figure out how to make it stop firing while keeping the assertion in-tact.
Attached patch patchSplinter Review
This assert can be bogus because the pendingGuardCondition snapshot won't necessarily be taken at the point of the outer snapshot. For example:

   setelem
   pop
   goto X

Now regs->pc will be at the "goto" and innermost->pc will be at "X".

The easiest thing to do is remove this assertion because, for its short existence, it helped catch two bugs. Unless someone has a better idea.
Attachment #403937 - Flags: review?(jorendorff)
That is, it helped catch two bugs and everything after has been false positives.
Attached file testcase?
Attachment #403937 - Flags: review?(jorendorff) → review+
http://hg.mozilla.org/tracemonkey/rev/00424b4a3db1

This should probably land on m-c because people are hitting this and complaining.
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/054909dfdcf8
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Duplicate of this bug: 520874
was running into this Assertion failure: regs->pc == innermost->pc, at /work/mozilla/builds/1.9.2/mozilla/js/src/jstracer.cpp:6297 when loading the youtube.com homepage during a topsite test
Flags: blocking1.9.2?
Severity: critical → normal
Priority: -- → P2
setting to all since i see this on 32bit windows debug builds too
OS: Linux → All
Hardware: x86_64 → All
Please b+. Needed for fennec testing. Not part of product builds.
+d
Flags: blocking1.9.2? → blocking1.9.2+
Assignee: general → dvander
Target Milestone: --- → mozilla1.9.3a1
this is a major pita for crash testing 1.9.2. Can we get it on 1.9.2 sooner than later?
(In reply to comment #12)
> this is a major pita for crash testing 1.9.2. Can we get it on 1.9.2 sooner
> than later?

i agree, i got 50-100 of this assertions during a topsite run, this assertion blocks Top Site Testing currently on 1.9.2
You need to log in before you can comment on or make changes to this bug.