519534 - Assertion failure: regs->pc == innermost->pc, at js/src/jstracer.cpp:6281

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Mats Palmgren (inactive)]

Attachment: Full stack trace

Assertion failure: regs->pc == innermost->pc, at js/src/jstracer.cpp:6281

My Firefox trunk debug build on x86_64 Linux crashes about 90% of the
time on startup.  If it survives the first few seconds it usually
crashes within minutes.

It looks like this assertion was added in bug 518492,
and has now been merged to mozilla-central?

I have attached "bt full" from gdb, let me know if you need anything else.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This specific trigger is bogus, I need to figure out how to make it stop firing while keeping the assertion in-tact.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: patch

This assert can be bogus because the pendingGuardCondition snapshot won't necessarily be taken at the point of the outer snapshot. For example:

   setelem
   pop
   goto X

Now regs->pc will be at the "goto" and innermost->pc will be at "X".

The easiest thing to do is remove this assertion because, for its short existence, it helped catch two bugs. Unless someone has a better idea.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

That is, it helped catch two bugs and everything after has been false positives.

Comment 4

[Jesse Ruderman]

Attachment: testcase?

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/00424b4a3db1

This should probably land on m-c because people are hitting this and complaining.

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/054909dfdcf8

Comment 8

[Carsten Book [:Tomcat]]

was running into this Assertion failure: regs->pc == innermost->pc, at /work/mozilla/builds/1.9.2/mozilla/js/src/jstracer.cpp:6297 when loading the youtube.com homepage during a topsite test

Comment 9

[Carsten Book [:Tomcat]]

setting to all since i see this on 32bit windows debug builds too

Comment 10

[Andreas Gal :gal]

Please b+. Needed for fennec testing. Not part of product builds.

Comment 11

[Mike Shaver (:shaver emeritus)]

+d

Comment 12

[Bob Clary [:bc] (inactive)]

this is a major pita for crash testing 1.9.2. Can we get it on 1.9.2 sooner than later?

Comment 13

[Carsten Book [:Tomcat]]

(In reply to comment #12)
> this is a major pita for crash testing 1.9.2. Can we get it on 1.9.2 sooner
> than later?

i agree, i got 50-100 of this assertions during a topsite run, this assertion blocks Top Site Testing currently on 1.9.2

Comment 14

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/2f4c4c857918