614780 - TM: "Assertion failure: !js_IsActiveWithOrBlock(cx, &regs.fp->scopeChain(), 0),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (a = 0; a < 9; ++a) {
    M: for (let c in <x>></x>) {
      break M
    }
}

asserts js debug shell on TM changeset 9123f97f059c with -j at Assertion failure: !js_IsActiveWithOrBlock(cx, &regs.fp->scopeChain(), 0),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: regression range

Due to cross compile breakage, attached is the regression window.

Comment 2

[Jesse Ruderman]

The first bad revision is:
changeset:   eaa6114ee405
user:        Luke Wagner <[e-mail]>
date:        Wed Nov 10 16:19:02 2010 -0800
summary:     Bug 604858 - break-to-label should endLoop(); assert that recording does not leave the original loop (r=dvander)

Stack:
> #0  JS_Assert
> #1  js::Interpret () at jsinterp.cpp:6986
> #2  js::RunScript (cx=0x609f30, script=0x612440, fp=0x1000030) at jsinterp.cpp:657
> #3  js::Execute (cx=0x609f30, chain=0x1502028, script=0x612440, prev=0x0, flags=0, result=0x0) at jsinterp.cpp:1005
> #4  JS_ExecuteScript (cx=0x609f30, obj=0x1502028, script=0x612440, rval=0x0) at jsapi.cpp:4837
> #5  Process (cx=0x609f30, obj=0x1502028, filename=0xbffff9d2 "jn.js", forceTTY=0) at shell/js.cpp:453
> #6  ProcessArgs (cx=0x609f30, obj=0x1502028, argv=0xbffff92c, argc=2) at shell/js.cpp:952
> #7  Shell (cx=0x609f30, argc=2, argv=0xbffff92c, envp=0xbffff938) at shell/js.cpp:5370
> #8  main (argc=2, argv=0xbffff92c, envp=0xbffff938) at shell/js.cpp:5478

Comment 3

[Luke Wagner [:luke]]

While labeled break has always traced, before the fix in bug 604858, labeled break would keep recording out of the inner loop (so effectively never close he loop).  With bug 604858, labeled break can record succesfully which exposes an incorrect assumption we make about the blockchains.  The issue is the 'let' in the for-loop initializer which (when we call js_GetScopeChain) places a block object on the scope chain.  In a normal break, the leaveblock is placed after the ifne backedge, so exiting trace, leaveblock is executed in the interp/mjit and all is good.  With a labeled break, the leaveblock happens inside the loop, before the goto, so it effectively happens on trace.  However, since the tracer ignores leaveblock, the block object is never popped from the scope chain.

The simple fix is to go back to not tracing labeled break.  A more sophisticated solution is to try to put some block-object-popping logic in LeaveTree.  I'm inclined to do the former, with a big comment as to what the problem is if we should later decide it is important to trace.

Comment 4

[Luke Wagner [:luke]]

Attachment: go back to not tracing labeled break

Taking the easy path to fix the blocker.  We can trace it later.

Comment 6

[Luke Wagner [:luke]]

Attachment: and don't trace labeled continue either

Labeled continue is broken for the same reason (as shown by bug 616119).  Btw, neither of this hurts v8/ss.

Comment 7

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/292dd34fdbbf

Comment 8

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/292dd34fdbbf

Comment 9

[Christian Holler (:decoder)]

Bug in removed tracer code, setting in-testsuite- flag.