520536 - Assertion failed: !s0->isQuad() && !s1->isQuad() - e4x/Regress/regress-458679-02.js

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

e4x/Regress/regress-458679-02.js

browser tracemonkey 64 bit linux so far. jit only.

Assertion failed: !s0->isQuad() && !s1->isQuad() (/work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/nanojit/LIR.cpp:2199)

Comment 1

[Bob Clary [:bc] (inactive)]

ditto js1_5/Regress/regress-159334.js

Comment 2

[Bob Clary [:bc] (inactive)]

another regression from bug 459301 it appears.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

I don't get this from running individual tests or the whole suite - could you show a full stack trace? And from gdb, at the line of the assertion, if possible:

p *s0
p *s1

Comment 4

[Bob Clary [:bc] (inactive)]

#0  0x00000032b4899751 in nanosleep () from /lib64/libc.so.6
#1  0x00000032b4899574 in sleep () from /lib64/libc.so.6
#2  0x00002b100fac1b2c in ah_crap_handler (signum=6) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/toolkit/xre/nsSigHandlers.cpp:149
#3  0x00002b100fac2b35 in nsProfileLock::FatalSignalHandler (signo=6) at nsProfileLock.cpp:216
#4  <signal handler called>
#5  0x00000032b4830215 in raise () from /lib64/libc.so.6
#6  0x00000032b4831cc0 in abort () from /lib64/libc.so.6
#7  0x00002b100fe96165 in NanoAssertFail () at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/nanojit/avmplus.cpp:66
#8  0x00002b100fe8d0a0 in nanojit::SanityFilter::ins2 (this=0xd7cf528, v=nanojit::LIR_eq, s0=0xfb4cc28, s1=0xfb4cc10) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/nanojit/LIR.cpp:2199
#9  0x00002b100fe4ae06 in TraceRecorder::slurpBoolSlot (this=0xe9bf420, val_ins=0xfb4cc00, vp=0xfad96a8, exit=0xf87cad8) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsrecursion.cpp:592
#10 0x00002b100fe4b3ce in TraceRecorder::slurpSlot (this=0xe9bf420, val_ins=0xfb4cc00, vp=0xfad96a8, exit=0xf87cad8) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsrecursion.cpp:667
#11 0x00002b100fe4e8d0 in TraceRecorder::slurpSlot (this=0xe9bf420, val_ins=0xfb4cc00, vp=0xfad96a8, info=0x7fff7b7b69d0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsrecursion.cpp:705
#12 0x00002b100fe70d06 in TraceRecorder::slurpDownFrames (this=0xe9bf420, return_pc=0xeb917cd ":") at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsrecursion.cpp:452
#13 0x00002b100fe71268 in TraceRecorder::upRecursion (this=0xe9bf420) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsrecursion.cpp:137
#14 0x00002b100fe71ca9 in TraceRecorder::record_JSOP_RETURN (this=0xe9bf420) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jstracer.cpp:9840
#15 0x00002b100fe742c7 in TraceRecorder::monitorRecording (cx=0xe727230, tr=0xe9bf420, op=JSOP_RETURN) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsopcode.tbl:118
#16 0x00002b100fd77580 in js_Interpret (cx=0xe727230) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsops.cpp:79
#17 0x00002b100fda4681 in js_Execute (cx=0xe727230, chain=0xe9f3a40, script=0xe109880, down=0x0, flags=0, result=0x0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsinterp.cpp:1598
#18 0x00002b100fd0d39a in JS_EvaluateUCScriptForPrincipals (cx=0xe727230, obj=0xe9f3a40, principals=0xeb5d228, chars=0xfb49728, length=2426, filename=0xf519ec8 "http://test.mozilla.com/tests/mozilla.org/js/e4x/Regress/regress-458679-02.js", lineno=1, rval=0x0)
    at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/jsapi.cpp:5054
#19 0x00002b10178d9424 in nsJSContext::EvaluateString (this=0xe7271c0, aScript=@0xe37ecc8, aScopeObject=0xe9f3a40, aPrincipal=0xeb5d220, aURL=0xf519ec8 "http://test.mozilla.com/tests/mozilla.org/js/e4x/Regress/regress-458679-02.js", aLineNo=1, aVersion=4246, 
    aRetValue=0x0, aIsUndefined=0x7fff7b7b7a2c) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/dom/base/nsJSEnvironment.cpp:1682
#20 0x00002b101769bd29 in nsScriptLoader::EvaluateScript (this=0xec976c0, aRequest=0xe37eca0, aScript=@0xe37ecc8) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:686
#21 0x00002b101769bfb1 in nsScriptLoader::ProcessRequest (this=0xec976c0, aRequest=0xe37eca0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:600
#22 0x00002b101769da23 in nsScriptLoader::ProcessScriptElement (this=0xec976c0, aElement=0xedac588) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:511
#23 0x00002b1017699a0e in nsScriptElement::MaybeProcessScript (this=0xedac588) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/base/src/nsScriptElement.cpp:193
#24 0x00002b1017782c3f in nsHTMLScriptElement::MaybeProcessScript (this=0xedac540) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:538
#25 0x00002b1017781403 in nsHTMLScriptElement::DoneAddingChildren (this=0xedac540, aHaveNotified=1) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:475
#26 0x00002b10177b3542 in HTMLContentSink::ProcessSCRIPTEndTag (this=0xf74ce60, content=0xedac540, aMalformed=0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:2962
#27 0x00002b10177b45f2 in SinkContext::CloseContainer (this=0x2aaaac0cf140, aTag=eHTMLTag_script, aMalformed=0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:1014
#28 0x00002b10177b4c47 in HTMLContentSink::CloseContainer (this=0xf74ce60, aTag=eHTMLTag_script) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:2274
#29 0x00002b1014f414b6 in CNavDTD::CloseContainer (this=0x2aaaac068510, aTag=eHTMLTag_script, aMalformed=0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:2704
#30 0x00002b1014f46a1b in CNavDTD::HandleEndToken (this=0x2aaaac068510, aToken=0xf7f38e0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:1627
#31 0x00002b1014f45378 in CNavDTD::HandleToken (this=0x2aaaac068510, aToken=0xf7f38e0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:718
#32 0x00002b1014f4714c in CNavDTD::BuildModel (this=0x2aaaac068510, aTokenizer=0xe969200, aCanInterrupt=0, aCountLines=0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:301
#33 0x00002b1014f51802 in nsParser::BuildModel (this=0xed0c960) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:2423
#34 0x00002b1014f573bb in nsParser::ResumeParse (this=0xed0c960, allowIteration=1, aIsFinalChunk=0, aCanInterrupt=1) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:2321
#35 0x00002b1014f58db5 in nsParser::ContinueInterruptedParsing (this=0xed0c960) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:1824
#36 0x00002b10175e54d0 in nsContentSink::ContinueInterruptedParsingIfEnabled (this=0xf74ce60) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/content/base/src/nsContentSink.cpp:1758
#37 0x00002b10175ec63e in nsRunnableMethod<nsContentSink, void>::Run (this=0xeb41c90) at ../../../dist/include/nsThreadUtils.h:264
#38 0x00002b10103d7068 in nsThread::ProcessNextEvent (this=0xcfa8bb0, mayWait=1, result=0x7fff7b7b873c) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/xpcom/threads/nsThread.cpp:527
#39 0x00002b10103627f0 in NS_ProcessNextEvent_P (thread=0xcfa8bb0, mayWait=1) at nsThreadUtils.cpp:230
#40 0x00002b101f3624dc in nsBaseAppShell::Run (this=0xd8a01a0) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#41 0x00002b101e3dd6b8 in nsAppStartup::Run (this=0xd54ce80) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:182
#42 0x00002b100fab29a0 in XRE_main (argc=3, argv=0x7fff7b7b9128, aAppData=0xcf4a590) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/toolkit/xre/nsAppRunner.cpp:3420
#43 0x0000000000401203 in main (argc=3, argv=0x7fff7b7b9128) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/browser/app/nsBrowserApp.cpp:156

(gdb) f 8
#8  0x00002b100fe8d0a0 in nanojit::SanityFilter::ins2 (this=0xd7cf528, v=nanojit::LIR_eq, s0=0xfb4cc28, s1=0xfb4cc10) at /work/mozilla/builds/1.9.3-tracemonkey/mozilla/js/src/nanojit/LIR.cpp:2199
2199                NanoAssert(!s0->isQuad() && !s1->isQuad());
(gdb) p *s0
$1 = {{lastWord = {arIndex = 0, reg = nanojit::RAX, used = 0, opcode = nanojit::LIR_qiand}, dummy = 0x69000000}}
(gdb) p *s1
$2 = {{lastWord = {arIndex = 0, reg = nanojit::RAX, used = 0, opcode = nanojit::LIR_quad}, dummy = 0x58000000}}
(gdb)

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Okay, the code is definitely wrong, I can reproduce this with trace-tests.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fixes

LIR typing bugs. pirsh needs a 32-bit RHS and LIR_eq should be platform-dependent.

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/517ddd2b9611

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/517ddd2b9611

Comment 9

[Bob Clary [:bc] (inactive)]

v 1.9.3