Closed Bug 600384 Opened 14 years ago Closed 14 years ago

Crash [@ js::mjit::FrameState::assertValidRegisterState] on Android on Tracemonkey

Categories

(Core :: JavaScript Engine, defect)

ARM
Android
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 600163

People

(Reporter: mwu, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

#0  0xafd0ed0c in kill () from libc.so
#1  0xafd137b6 in raise () from libc.so
#2  0x812a7c10 in js::mjit::FrameState::assertValidRegisterState (
    this=0x4a10d7e8)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/FrameState.cpp:345
#3  0x8129ae84 in js::mjit::Compiler::generateMethod (this=0x4a10cdd0)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/Compiler.cpp:1702
#4  0x8129dca4 in js::mjit::Compiler::Compile (this=0x4a10cdd0)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/Compiler.cpp:144
#5  0x8129dfec in js::mjit::TryCompile (cx=0x4a626bc0, script=0x4d4cdb00, 
    fun=<value optimized out>, scopeChain=<value optimized out>)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/Compiler.cpp:174
#6  0x810ed218 in CanMethodJIT (cx=0x4a626bc0, script=0x4d4cdb00, 
    fun=0x4d555b40, scopeChain=...)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/MethodJIT.h:213
#7  js::RunScript (cx=0x4a626bc0, script=0x4d4cdb00, fun=0x4d555b40, 
    scopeChain=...) at /fasthome/mikew/moz/tracemonkey/js/src/jsinterp.cpp:477
#8  0x810f108c in js::Invoke (cx=0x4a626bc0, argsRef=<value optimized out>, 
    flags=<value optimized out>)
    at /fasthome/mikew/moz/tracemonkey/js/src/jsinterp.cpp:593
#9  0x810b1588 in js_fun_apply (cx=0x4a626bc0, argc=<value optimized out>, 
    vp=0x4cfa8848) at /fasthome/mikew/moz/tracemonkey/js/src/jsfun.cpp:2390
#10 0x812c84d0 in CallCompiler::generateNativeStub() ()
   from /fasthome/mikew/moz/tm-droid-debug/dist/bin/libmozjs.so
#11 0x812c76b4 in js::mjit::ic::NativeCall (f=..., index=<value optimized out>)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/MonoIC.cpp:687
#12 0x81279ed0 in JaegerStubVeneer ()
   from /fasthome/mikew/moz/tm-droid-debug/dist/bin/libmozjs.so
#13 0x43129848 in ?? ()
#14 0x43129848 in ?? ()
tracking-fennec: --- → ?
What's the assert? It sounds like the same as bug 600163. There's a patch in there if you want to try it.
Patch works as expected. Thanks!
Status: NEW → RESOLVED
tracking-fennec: ? → ---
Closed: 14 years ago
Resolution: --- → DUPLICATE
Severity: normal → critical
Summary: Crash @js::mjit::FrameState::assertValidRegisterState on Android on Tracemonkey → Crash [@ js::mjit::FrameState::assertValidRegisterState] on Android on Tracemonkey
Crash Signature: [@ js::mjit::FrameState::assertValidRegisterState]
You need to log in before you can comment on or make changes to this bug.