616119 - TM: "Assertion failure: pc >= beg - JSOP_GOTO_LENGTH && pc <= end"

Status: RESOLVED DUPLICATE of bug 614780

(Core :: JavaScript Engine, defect)

Description

[Jérôme Vouillon]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.1.15) Gecko/20101028 Iceweasel/3.5.15 (like Firefox/3.5.15)
Build Identifier: 

The attached piece of code makes a debug build of tracemonkey abort with the following assertion failure when the TraceMonkey tracing JIT is enabled:

> js -j nested.js
Assertion failure: pc >= beg - JSOP_GOTO_LENGTH && pc <= end, at jstracer.cpp:6930

I encountered this issue while trying to investigate why a program (also attached) runs very slowly when the tracing JIT is enabled (it seems most of the time is spent in recording traces).  The programs also results in an assertion failure with a debugging build.  I'm wondering whether the performance issue and the failure are related.

Reproducible: Always

Comment 1

[Jérôme Vouillon]

Attachment: Short piece of code producing an assertion failure

Comment 2

[Jérôme Vouillon]

Attachment: Initial program

Comment 3

[Nicholas Nethercote [inactive]]

Here's an even simpler reproducer:

var i = 1;
l:
for (;;)
    for (; i--; )
        for (; i--; )
            continue l;

Comment 4

[Bob Clary [:bc] (inactive)]

Assertion also seen with linux/mac mozilla-central at:
http://www.jigzone.com/puzzles/45055D50C3C7?z=6

Comment 6

[Christian Holler (:decoder)]

Bug in removed tracer code, setting in-testsuite- flag.