Closed Bug 626592 Opened 9 years ago Closed 9 years ago

Assertion failure: op == JSOP_CALL || ... in LeaveTree

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla2.0b11

People

(Reporter: decoder, Assigned: jorendorff)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

The following code

options('tracejit');
this.__defineGetter__("x", Function);
this.watch('x', Math.pow); (function() { for(var j=0;j<10;++j){x=1;} })();

triggers this assertion in TM tip:

Assertion failure: op == JSOP_CALL || op == JSOP_FUNAPPLY || op == JSOP_FUNCALL || op == JSOP_NEW || op == JSOP_GETPROP || op == JSOP_GETTHISPROP || op == JSOP_GETARGPROP || op == JSOP_GETLOCALPROP || op == JSOP_LENGTH || op == JSOP_GETELEM || op == JSOP_CALLELEM || op == JSOP_CALLPROP || op == JSOP_SETPROP || op == JSOP_SETNAME || op == JSOP_SETMETHOD || op == JSOP_SETELEM || op == JSOP_INITELEM || op == JSOP_ENUMELEM || op == JSOP_INSTANCEOF || op == JSOP_ITER || op == JSOP_MOREITER || op == JSOP_ENDITER || op == JSOP_FORARG || op == JSOP_FORLOCAL || op == JSOP_FORNAME || op == JSOP_FORPROP || op == JSOP_FORELEM || op == JSOP_DELPROP || op == JSOP_DELELEM, at jstracer.cpp:6748
To speed this up a bit, I made a bisect.

The first bad revision is:
changeset:   60411:33c58d16d911
user:        Jason Orendorff
date:        Fri Jan 14 16:18:53 2011 -0600
summary:     Bug 559653 - Record assignment before the interpreter goes, mostly. This reduces record_SetPropHit to a narrower callback, record_AddProperty. r=brendan.
Blocks: 559653
Keywords: regression
Fyi,

(gdb) print op
$1 = JSOP_SETGNAME
Maybe just a bogus assert, since SETGNAME is basically SETPROP?
That assertion is pretty bogus. We just keep changing things to require another op to be added to the huge disjunction. Is it worth it?

/be
I'm going to take it out.
Assignee: general → jorendorff
Attached patch v1Splinter Review
Attachment #505878 - Flags: review?(danderson)
Attachment #505878 - Flags: review?(danderson) → review+
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/caca24ca36cd
Note: not marking as fixed because fixed-in-tracemonkey is not present on the whiteboard.
Looks fixed to me.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla2.0b11
Blocks: 676763
Filter on qa-project-auto-change:

Bug in removed tracer code, setting in-testsuite- flag.
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.