524061 - TM: "Assertion failure: isNumber(*p) == (t == TT_DOUBLE), at ../jstracer.cpp" with recursion

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function f(gvxbfu, b) {
    if (gvxbfu.length == b) {
        return (<x></x>.(b))
    }
    var c = gvxbfu[b]
    a = f(gvxbfu,b+1)
    return((
        function g(d,e){
            return d.length == e ? 0 : d[e]+g(d,e+1)
        })
        ([,Infinity,c,Infinity,Infinity,c,c],0)
    )
})([,String,new String,,,,this],0)

asserts js debug shell with -j on TM tip at Assertion failure: isNumber(*p) == (t == TT_DOUBLE), at ../jstracer.cpp:3399

I suspect this is due to tracerecursion bug 459301..

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Okay, this is sort of related to bug 521447. Part of the complication in that patch was making sure we never use the tracker for so-called "slurp fail" exits. I left the tracker code in though, which was a mistake.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

This patch does three things:
 1. Stops using the tracker entirely for slurp-fail exits.
 2. Removes the special case from import() for only importing rvals.
 3. Uses canonical "vp" for jsval pointer instead of "v" in SlotMap.

Comment 3

[Andreas Gal :gal]

Comment on attachment 408058 [details] [diff] [review]
fix

I remember complaining about the slurp code in there before, so good riddance.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/e18bbc8cb527

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/e18bbc8cb527

Comment 6

[Christian Holler (:decoder)]

Bug in removed tracer code, setting in-testsuite- flag.