JM: Assertion failure: offset == stubShapeJumpOffset, at ../methodjit/ICLabels.h:321

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: jandem, Assigned: jbramley)

Tracking

unspecified
x86
Mac OS X
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

7 years ago
This test case:
---
gczeal(2);

for(var i=0; i<20; i++) {
    function f() {
        for (var j = 0; j < 3; j++) {
            (function() {})();
        }
    }
    f();
}
---
Asserts with -m (32-bit OS X):

Assertion failure: offset == stubShapeJumpOffset, at ../methodjit/ICLabels.h:321
(Reporter)

Updated

7 years ago
blocking2.0: --- → ?
Summary: Assertion failure: offset == stubShapeJumpOffset, at ../methodjit/ICLabels.h:321 → JM: Assertion failure: offset == stubShapeJumpOffset, at ../methodjit/ICLabels.h:321
(Reporter)

Comment 1

7 years ago
Further reduced:
--
gczeal(2);
for(var i=0; i<20; i++) {
    function f() {
        (function() {})();
    }
    f();
}
--
Created attachment 503790 [details] [diff] [review]
Fix force32 regression.
Assignee: general → cdleary
Status: NEW → ASSIGNED
Attachment #503790 - Flags: review?(Jacob.Bramley)
Attachment #503790 - Flags: review?(Jacob.Bramley) → review+
http://hg.mozilla.org/tracemonkey
Whiteboard: fixed-in-tracemonkey
Whoops: http://hg.mozilla.org/tracemonkey/rev/e8c8df3f17f2
(Assignee)

Comment 5

7 years ago
Created attachment 503797 [details] [diff] [review]
Update to make things more robust.

 • Make branch32WithPatch behave like branch32_force32 on x86.
 • Make branch32_force32 more robust on ARM.
 • Rename branch32_force32 to the more-appropriate 'branch32FixedLength'.
Assignee: cdleary → Jacob.Bramley
Attachment #503790 - Attachment is obsolete: true
Attachment #503797 - Flags: review?(cdleary)
(Assignee)

Comment 6

7 years ago
(In reply to comment #5)
> Created attachment 503797 [details] [diff] [review]
> Update to make things more robust.

Passes jit-tests on x86, amd64 and ARM with m, mj and mjp.
(Assignee)

Updated

7 years ago
Whiteboard: fixed-in-tracemonkey
Attachment #503797 - Flags: review?(cdleary) → review+
http://hg.mozilla.org/tracemonkey/rev/fbcba31f6380
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/fbcba31f6380
http://hg.mozilla.org/mozilla-central/rev/e8c8df3f17f2
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
blocking2.0: ? → betaN+
You need to log in before you can comment on or make changes to this bug.