551603 - JM: "Assertion failure: (*cx->regs->pc == JSOP_TRACE || *cx->regs->pc == JSOP_NOP || *cx->regs->pc == JSOP_RETURN) && !cx->fp->imacpc, at ../jstracer.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  ((function f(a) {
    if (a > 0) {
      f(a - 1)
    }
  })(6))
})()

asserts js debug shell on JM tip with -j at Assertion failure: (*cx->regs->pc == JSOP_TRACE || *cx->regs->pc == JSOP_NOP || *cx->regs->pc == JSOP_RETURN) && !cx->fp->imacpc, at ../jstracer.cpp:4599

(Not the smallest) regression window:

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/pushloghtml?fromchange=f2c8a8d35d6f&tochange=8ff511be9370

Shell does not seem to build successfully when further bisected.

Comment 1

[Luke Wagner [:luke]]

Missing new case in assert.  David said might have been lost in a merge conflict.
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/e473a7851167

Comment 2

[Luke Wagner [:luke]]

Oops, forgot to add the test case:
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/b1a5da7e37b8

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> Missing new case in assert.  David said might have been lost in a merge
> conflict.
> http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/e473a7851167

(In reply to comment #2)
> Oops, forgot to add the test case:
> http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/b1a5da7e37b8

Resolved FIXED.

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug551603.js.