621874 - Assertion failure: payload->isI()

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

mozjs.dll!JS_Assert(const char * s=0x00abda1c, const char * file=0x00abd2f8, int ln=665)  Line 73	C++
>	mozjs.dll!js::tjit::Writer::stiValuePayload(nanojit::LIns * payload=0x089f2d90, js::tjit::Address addr={...})  Line 665 + 0x25 bytes	C++
 	mozjs.dll!js::TraceRecorder::box_value_into(const js::Value & v={...}, nanojit::LIns * v_ins=0x089f2d90, js::tjit::Address addr={...})  Line 9642	C++
 	mozjs.dll!js::TraceRecorder::incElem(int incr=1, bool pre=false)  Line 8763	C++
 	mozjs.dll!js::TraceRecorder::record_JSOP_ELEMINC()  Line 11728 + 0xc bytes	C++
 	mozjs.dll!js::TraceRecorder::monitorRecording(JSOp op=JSOP_ELEMINC)  Line 171 + 0x1b bytes	C++
 	mozjs.dll!js::Interpret(JSContext * cx=0x077be1d0, JSStackFrame * entryFrame=0x04b10078, unsigned int inlineCallCount=0, JSInterpMode interpMode=JSINTERP_RECORD)  Line 2667 + 0xc bytes	C++
 	mozjs.dll!js::RecordTracePoint(JSContext * cx=0x077be1d0, unsigned int & inlineCallCount=0, bool * blacklist=0x0012cbc7, bool execAllowed=true)  Line 16414 + 0x15 bytes	C++
 	mozjs.dll!js::MonitorTracePoint(JSContext * cx=0x077be1d0, unsigned int & inlineCallCount=0, bool * blacklist=0x0012cbc7, void * * traceData=0x089f2984, unsigned int * traceEpoch=0x089f2988)  Line 16561 + 0x18 bytes	C++
 	mozjs.dll!RunTracer(js::VMFrame & f={...}, js::mjit::ic::TraceICInfo & tic={...})  Line 964 + 0x1c bytes	C++
 	mozjs.dll!js::mjit::stubs::InvokeTracer(js::VMFrame & f={...}, js::mjit::ic::TraceICInfo * tic=0x089f2970)  Line 1054 + 0xd bytes	C++
 	0cbc9ec6()	
 	mozjs.dll!js::mjit::EnterMethodJIT(JSContext * cx=0x077be1d0, JSStackFrame * fp=0x04b10030, void * code=0x0cbc8e6c, js::Value * stackLimit=0x04b9ca60)  Line 745 + 0x15 bytes	C++
 	mozjs.dll!CheckStackAndEnterMethodJIT(JSContext * cx=0x077be1d0, JSStackFrame * fp=0x04b10030, void * code=0x0cbc8e6c)  Line 770 + 0x15 bytes	C++
 	mozjs.dll!js::mjit::JaegerShot(JSContext * cx=0x077be1d0)  Line 787 + 0x19 bytes	C++

Comment 2

[Jesse Ruderman]

I can reproduce using the URL in comment 1 on mozilla-central, but not on tracemonkey branch.  (Using Mac debug builds.)

Comment 3

[Bob Clary [:bc] (inactive)]

Is tracemonkey going to be fully merged with mozilla-central going forward?

Comment 4

[Brendan Eich [:brendan]]

(In reply to comment #3)
> Is tracemonkey going to be fully merged with mozilla-central going forward?

Yes, AFAIK. Sayrer will contradict if I'm wrong.

/be