Closed Bug 611724 Opened 9 years ago Closed 9 years ago

Assertion failure in TraceRecorder::emitIf()

Categories

(Core :: JavaScript Engine, defect)

x86
Windows XP
defect
Not set

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: soubok, Assigned: njn)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(4 files, 1 obsolete file)

Assertion failure: isCond(x), at .../js/src/jstracer.cpp:5327
  => JS_ASSERT(isCond(x))  in  TraceRecorder::emitIf()
version: latest tracemonkey tip
Attached file stacktrace
js source code:

function test() {}
var b = Blob('1');
for (var i = 0; i < 71; i++ ) // I mean exactly 71 times or more
	for each ( var it in b )
		test();

Blob is a JSClass that defines ext.iteratorObject

(trying to create a complete testcase...)
blocking2.0: --- → ?
Attached file testcase (obsolete) —
Attached file simpler testcase
Attachment #490148 - Attachment is obsolete: true
Franck, I am unable to compile your test case.  Can you give instructions for how to compile it?  A JavaScript test would be much easier to deal with, if you can concoct one.

Nonetheless, from the stack trace I think I see what the problem is.  Attached patch is a possible fix.  Franck, can you test it?
Attachment #490508 - Flags: review?(gal)
The patch fix the assert failure.

Note that I use msvc to compile my testcase and the assert failure only happens in debug build.
However I still have some strange behavior with my custom iterator object when JSOPTION_JIT is enabled.
It is like if my JS_ThrowStopIteration has no more effect in an array comprehension statement.
I am trying to create another testcase for this behavior without success...
Attached file testcase
With your patch applied, this new testcase hangs on when run in debug mode in msvc9.
Attachment #490508 - Flags: review?(gal) → review?(dvander)
(In reply to comment #7)
> However I still have some strange behavior with my custom iterator object when
> JSOPTION_JIT is enabled.

That's a different issue.  Can you please file a new bug report?  It makes tracking things easier if there's only one issue per bug report.  Thanks.
Assignee: general → nnethercote
Attachment #490508 - Flags: review?(dvander) → review+
Bug 612523 has been created.
http://hg.mozilla.org/tracemonkey/rev/3c580750fa38
Whiteboard: fixed-in-tracemonkey
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.