600384 - Crash [@ js::mjit::FrameState::assertValidRegisterState] on Android on Tracemonkey

Status: RESOLVED DUPLICATE of bug 600163

(Core :: JavaScript Engine, defect)

Description

[Michael Wu [:mwu]]

#0  0xafd0ed0c in kill () from libc.so
#1  0xafd137b6 in raise () from libc.so
#2  0x812a7c10 in js::mjit::FrameState::assertValidRegisterState (
    this=0x4a10d7e8)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/FrameState.cpp:345
#3  0x8129ae84 in js::mjit::Compiler::generateMethod (this=0x4a10cdd0)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/Compiler.cpp:1702
#4  0x8129dca4 in js::mjit::Compiler::Compile (this=0x4a10cdd0)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/Compiler.cpp:144
#5  0x8129dfec in js::mjit::TryCompile (cx=0x4a626bc0, script=0x4d4cdb00, 
    fun=<value optimized out>, scopeChain=<value optimized out>)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/Compiler.cpp:174
#6  0x810ed218 in CanMethodJIT (cx=0x4a626bc0, script=0x4d4cdb00, 
    fun=0x4d555b40, scopeChain=...)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/MethodJIT.h:213
#7  js::RunScript (cx=0x4a626bc0, script=0x4d4cdb00, fun=0x4d555b40, 
    scopeChain=...) at /fasthome/mikew/moz/tracemonkey/js/src/jsinterp.cpp:477
#8  0x810f108c in js::Invoke (cx=0x4a626bc0, argsRef=<value optimized out>, 
    flags=<value optimized out>)
    at /fasthome/mikew/moz/tracemonkey/js/src/jsinterp.cpp:593
#9  0x810b1588 in js_fun_apply (cx=0x4a626bc0, argc=<value optimized out>, 
    vp=0x4cfa8848) at /fasthome/mikew/moz/tracemonkey/js/src/jsfun.cpp:2390
#10 0x812c84d0 in CallCompiler::generateNativeStub() ()
   from /fasthome/mikew/moz/tm-droid-debug/dist/bin/libmozjs.so
#11 0x812c76b4 in js::mjit::ic::NativeCall (f=..., index=<value optimized out>)
    at /fasthome/mikew/moz/tracemonkey/js/src/methodjit/MonoIC.cpp:687
#12 0x81279ed0 in JaegerStubVeneer ()
   from /fasthome/mikew/moz/tm-droid-debug/dist/bin/libmozjs.so
#13 0x43129848 in ?? ()
#14 0x43129848 in ?? ()

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

What's the assert? It sounds like the same as bug 600163. There's a patch in there if you want to try it.

Comment 2

[Michael Wu [:mwu]]

Patch works as expected. Thanks!