TM: Assertion failure: !cx->regs->fp->hasImacropc(), at ./jscntxtinlines.h:424

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

6 years ago
The following code asserts TM revision 5550f333d8c8 when run with -j -m (tested on 64 bit):

test();
function test()
{
  var code = "", obj = {};
  for(var i = 0; i < 0x10000; i++) {
      if(i == 10242) {
        return test.call(obj, obj);
      } else {
        code += "void 'x" + i + "';\n";
      }
  } 
}
Flags: wanted-fennec1.0?
I'm not sure but this assert seems to be more frequent now. Here's a simpler test case:
--
for (var i = 0; i < 20; i++) {
    (function () {
        try {
            JSON.parse();
        } catch (e) {}
    }).call();
}
--
Asserts with -j, 32-bit OS X. Top stack frames:

#1  0x0012387c in ReconstructImacroPCStack (cx=0x70b770, script=0x70de20, imacstart=0x38c2a0 "OQ@:", target=0x38c2a3 ":", pcstack=0x0) at jsopcode.cpp:5504
#2  0x00123939 in ReconstructPCStack (cx=0x70b770, script=0x70de20, target=0x38c2a3 ":", pcstack=0x0) at jsopcode.cpp:5529
#3  0x00123c54 in js_ReconstructStackDepth (cx=0x70b770, script=0x70de20, pc=0x38c2a3 ":") at jsopcode.cpp:5364
#4  0x001e350b in js::StackIter::settleOnNewState (this=0xbfffe238) at vm/Stack.cpp:941
#5  0x001e39c5 in js::StackIter::operator++ (this=0xbfffe238) at vm/Stack.cpp:1018
#6  0x0001220b in js::FrameRegsIter::operator++ (this=0xbfffe238) at Stack.h:1679
(Assignee)

Comment 2

6 years ago
Oops, that js_ReconstructStack is in an assert that needs a:
  JS_ASSERT_IF(!fp->hasImacropc(), 
in front of it.
(Assignee)

Comment 3

6 years ago
Created attachment 539658 [details] [diff] [review]
fix assert

hate imacros
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #539658 - Flags: review?(jwalden+bmo)
(Assignee)

Comment 4

6 years ago
Created attachment 539689 [details] [diff] [review]
fix assert

Oops, last patch inverted the new assert it added.
Attachment #539658 - Attachment is obsolete: true
Attachment #539658 - Flags: review?(jwalden+bmo)
Attachment #539689 - Flags: review?(jwalden+bmo)
Comment on attachment 539689 [details] [diff] [review]
fix assert

Review of attachment 539689 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/Stack.cpp
@@ +947,5 @@
>                      args_ = CallArgsFromVp(argc, vp);
>                      return;
>                  }
>              } else if (op == JSOP_FUNAPPLY) {
> +                JS_ASSERT(!fp_->hasImacropc());

But but but I had an awesome idea for an optimization that used JSOP_FUNAPPLY from an imacro!!!1!
Attachment #539689 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Updated

6 years ago
Duplicate of this bug: 664668
(Assignee)

Comment 7

6 years ago
(In reply to comment #5)
stab

http://hg.mozilla.org/tracemonkey/rev/b65724d6c326
Whiteboard: fixed-in-tracemonkey
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/b65724d6c326
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 9

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug648438.js.
Flags: in-testsuite+
(Reporter)

Updated

4 years ago
Flags: wanted-fennec1.0?
You need to log in before you can comment on or make changes to this bug.