Closed Bug 551603 Opened 12 years ago Closed 12 years ago

JM: "Assertion failure: (*cx->regs->pc == JSOP_TRACE || *cx->regs->pc == JSOP_NOP || *cx->regs->pc == JSOP_RETURN) && !cx->fp->imacpc, at ../jstracer.cpp"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

(function() {
  ((function f(a) {
    if (a > 0) {
      f(a - 1)
    }
  })(6))
})()

asserts js debug shell on JM tip with -j at Assertion failure: (*cx->regs->pc == JSOP_TRACE || *cx->regs->pc == JSOP_NOP || *cx->regs->pc == JSOP_RETURN) && !cx->fp->imacpc, at ../jstracer.cpp:4599

(Not the smallest) regression window:

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/pushloghtml?fromchange=f2c8a8d35d6f&tochange=8ff511be9370

Shell does not seem to build successfully when further bisected.
Missing new case in assert.  David said might have been lost in a merge conflict.
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/e473a7851167
(In reply to comment #1)
> Missing new case in assert.  David said might have been lost in a merge
> conflict.
> http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/e473a7851167

(In reply to comment #2)
> Oops, forgot to add the test case:
> http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/b1a5da7e37b8

Resolved FIXED.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug551603.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.