641225 - TI+JM: Assertion failure: failed to find call site, at ../methodjit/Retcon.cpp:91

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Test

This assert is rare and hard to reduce, I hope you can reproduce.

$ ./js -m -n -a test.js
Assertion failure: failed to find call site, at ../methodjit/Retcon.cpp:91

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Stack trace

Comment 2

[Brian Hackett [Laid off!]]

Hmm, I can't get this to reproduce.  How does it look under valgrind?  The hard-to-reproduce aspect probably means either uses of uninitialized data or the conservative GC are involved.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Test 2

The original test case does not assert anymore. The new attachment still asserts with -m -a -n at revision 1ce8efbb75cc. Valgrind does not show any messages.

Comment 4

[Brian Hackett [Laid off!]]

Cool, this asserts for me now.

Comment 5

[Brian Hackett [Laid off!]]

The recompiler reads each frame's ncode to determine whether it returns into the script being recompiled.  The problem is that frames which are evaluated by the interpreter leave this field uninitialized, now that field is NULL'ed out for interpreter frames.

http://hg.mozilla.org/projects/jaegermonkey/rev/6dc4e473aa06

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/releases/mozilla-release/rev/ba01e1b00f8c
[INFER] Compute PC for interpreted frames which failed to compile, bug 641225.