Last Comment Bug 684576 - Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:977
: Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:977
Status: RESOLVED FIXED
fixed-in-jaegermonkey
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
: 684789 (view as bug list)
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-09-04 04:56 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 07:59 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
-


Attachments

Description Christian Holler (:decoder) 2011-09-04 04:56:05 PDT
The following test asserts on mozilla-central revision a351ae35f2c4 (options -m -n -a):


function f0(p0,p1) {
    var v3;
    do {
        p1 > v3
        v3=1.7
    } while (((p0[p1][5]==1)||(p0[p1][5]==2)||(p0[p1][5] == 3)) + 0 > p0);
    + (v3(f0));
}
f0(4105,8307);


Note: The specified mozilla-central revision had a build problem with standalone shell, patch from http://hg.mozilla.org/integration/mozilla-inbound/rev/fff3dc9478ce fixes this.
Comment 1 Brian Hackett (:bhackett) 2011-09-05 17:35:19 PDT
Wrong test used when identifying entries whose type weakens from double to unknown on a branch, and need to be reset if used to hold a GP reg on the branch.  The frame entry itself was tested, rather than the known type information shadowing the frame entry, and the frame entry is not required to reflect that known type.  Before branching to a bytecode where the entry was in a GP reg, that reg was loaded for the entry's payload but not forgotten after the branch finished.

http://hg.mozilla.org/projects/jaegermonkey/rev/370d051a4c95
Comment 2 Jan de Mooij [:jandem] 2011-09-06 07:05:11 PDT
*** Bug 684789 has been marked as a duplicate of this bug. ***
Comment 3 Boris Zbarsky [:bz] 2011-09-06 08:21:33 PDT
Requesting tracking for Firefox 9 to make sure we merge this to m-c, since otherwise bug 684789 is a problem.
Comment 4 Brian Hackett (:bhackett) 2011-09-06 22:38:09 PDT
http://hg.mozilla.org/mozilla-central/rev/370d051a4c95
Comment 5 Christian Holler (:decoder) 2013-01-14 07:59:09 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug684576.js.

Note You need to log in before you can comment on or make changes to this bug.