640102 - TI: "Assertion failure: !isEntryCopied(fe),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

eval("v>>([]=x)")

asserts js debug shell on JM changeset 60670ecd2133 at Assertion failure: !isEntryCopied(fe), with -m, -n and -a.

Comment 1

[Brian Hackett [Laid off!]]

FrameState::isEntryCopied, used to check whether the copied bit on a frame entry is correct, shouldn't look at entries which have been popped off the stack (but which still show up in the tracker).

http://hg.mozilla.org/projects/jaegermonkey/rev/e348689923e5

Comment 2

[Brendan Eich [:brendan]]

Better to add nfe < sp to the loop condition? Why keep going with no hope of true return?

/be

Comment 3

[Brian Hackett [Laid off!]]

That should be correct, though it additionally depends on the invariant that tracker entries are ordered according to the stack slots.  I've shot myself in the foot enough times using the FrameState that I tend to write code using it conservatively (and things still break everywhere).  Can fix this when I fix bug 640614, which is the same problem as this one.

Comment 4

[Brian Hackett [Laid off!]]

Actually, it looks like the ordering invariant in the tracker only applies to copies, i.e. we assert that if fe copies nfe, fe > nfe and fe's tracker index > nfe's tracker index.  So you could get a premature return by moving the nfe < sp to the loop condition if the tracker was A B C where C copies A but B is >= sp.

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug640102.js.