611724 - Assertion failure in TraceRecorder::emitIf()

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Franck]

Assertion failure: isCond(x), at .../js/src/jstracer.cpp:5327
  => JS_ASSERT(isCond(x))  in  TraceRecorder::emitIf()
version: latest tracemonkey tip

Comment 1

[Franck]

Attachment: stacktrace

Comment 2

[Franck]

js source code:

function test() {}
var b = Blob('1');
for (var i = 0; i < 71; i++ ) // I mean exactly 71 times or more
	for each ( var it in b )
		test();

Blob is a JSClass that defines ext.iteratorObject

(trying to create a complete testcase...)

Comment 3

[Franck]

Attachment: testcase

Comment 4

[Franck]

Attachment: simpler testcase

Comment 5

[Nicholas Nethercote [:njn] (On Long Service Leave)]

Attachment: patch (against TM 57102:d3f5185f0392)

Franck, I am unable to compile your test case.  Can you give instructions for how to compile it?  A JavaScript test would be much easier to deal with, if you can concoct one.

Nonetheless, from the stack trace I think I see what the problem is.  Attached patch is a possible fix.  Franck, can you test it?

Comment 6

[Franck]

The patch fix the assert failure.

Note that I use msvc to compile my testcase and the assert failure only happens in debug build.

Comment 7

[Franck]

However I still have some strange behavior with my custom iterator object when JSOPTION_JIT is enabled.
It is like if my JS_ThrowStopIteration has no more effect in an array comprehension statement.
I am trying to create another testcase for this behavior without success...

Comment 8

[Franck]

Attachment: testcase

With your patch applied, this new testcase hangs on when run in debug mode in msvc9.

Comment 9

[Nicholas Nethercote [:njn] (On Long Service Leave)]

(In reply to comment #7)
> However I still have some strange behavior with my custom iterator object when
> JSOPTION_JIT is enabled.

That's a different issue.  Can you please file a new bug report?  It makes tracking things easier if there's only one issue per bug report.  Thanks.

Comment 10

[Franck]

Bug 612523 has been created.

Comment 11

[Nicholas Nethercote [:njn] (On Long Service Leave)]

http://hg.mozilla.org/tracemonkey/rev/3c580750fa38

Comment 12

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3c580750fa38