549393 - TM: "Assertion failure: disp == ((base == lirbuf->sp) ? nativespOffset(p) : nativeGlobalOffset(p)), at ../jstracer.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function start() {
  MAX_TOTAL_TIME = startTime = new Date
  do {
  if (rnd(0)) return (a[rnd()])()
    lastTime = new Date
  } while ( lastTime - startTime < MAX_TOTAL_TIME )
}
function MersenneTwister19937() {
  this.init_genrand = function() {
    for (mti = 1; mti < 4; mti++) {
      Array[mti] = 1
    }
  };
  this.genrand_int32 = function() {
    if (mti > 4) {
      mti = 0
    }
    return Array[mti++];
  }
} (function() {
  fuzzMT = new MersenneTwister19937;
  fuzzMT.init_genrand()
  rnd = function() {
    return Math.floor(fuzzMT.genrand_int32())
  }
} ())
function weighted(wa) {
  a = []
  for (i = 0; i < wa.length; ++i) {
    for (var j = 0; j < 8; ++j) {
      a.push(wa[i].fun)
    }
  }
}
statementMakers = weighted([{
  fun: function makeMixedTypeArray() { [[, , , , , , , , , , , , , , , , , , , , , , , , ""][(a[rnd()])()]]}
}])
start() 


Using JM repository rev 2e244af372f2 ( http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/2e244af372f2 ), this asserts in Assertion failure: disp == ((base == lirbuf->sp) ? nativespOffset(p) : nativeGlobalOffset(p)), at ../jstracer.cpp:3643

This occurs only with -j and only in JM repository. dvander indicates Luke might be testing something there, so might not be methodJIT-related...

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Seems to be related to the patch in bug 540706...

Comment 2

[Luke Wagner [:luke]]

I tested with just the bug 540706 patch applied, with no assert.  Will have to investigate further with David.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/46534269b967

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: patch for luke

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Not yet completely fixed on JM:

(function () {
    for (var q = 0; q < 6; ++q) {
        x: (function () {
            var m = (function () {})()
        })([0, , 0, 0, 0, , 0, 0, 0, , 0, 0, 0, , 0, 0, 0, 0, 0, 0, Number(1)])
    }
})()

asserts js debug shell with -j on JM rev 51898db0bbc9 at Assertion failure: disp == ((base == lirbuf->sp) ? nativespOffset(p) : nativeGlobalOffset(p)), at ../jstracer.cpp:3643

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: take two

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/1583ef6e7c4e

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug549393-1.js.