Assertion failure: !ic.pools[index], at /tmp/js/mozilla-central-ed4026a18fdb/js/src/methodjit/MonoIC.cpp:706

RESOLVED INVALID

Status

()

Core
JavaScript Engine
RESOLVED INVALID
7 years ago
6 years ago

People

(Reporter: paraboul, Unassigned)

Tracking

Trunk
x86
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: wanted-standalone-js)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 566375 [details]
crash.js

User Agent: Mozilla/5.0 (X11; Linux i686; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
Build ID: 20110928134238

Steps to reproduce:

Run attached file with -m -j using valgrind (./configure --enable-debug --enable-valgrind).

gcc version 4.4.5


Actual results:

Assertion failure: !ic.pools[index], at /tmp/js/mozilla-central-ed4026a18fdb/js/src/methodjit/MonoIC.cpp:706
(Reporter)

Comment 1

7 years ago
(same result with 1.8.5 build)

Updated

7 years ago
Whiteboard: wanted-standalone-js
Attachment #566375 - Attachment mime type: application/octet-stream → text/plain
I can't repro this in 64-bit builds on OS 10.6. 

What actually triggers the assert? Is it building with --enable-valgrind, or is it running under valgrind?
(Reporter)

Comment 3

7 years ago
I also run a 64bit build.

It only happens when running with valgrind (valgrind ./js -m -j).
It's indeed built with --enable-valgrind.
(Reporter)

Comment 4

7 years ago
$ valgrind --version
valgrind-3.6.0.SVN-Debian
tl;dr: use valgrind --smc-check=all-non-file

I just had the same issue, and realize that I forgot to add --smc-check=all-non-file which is necessary to tell valgrind that some code is generated and that it should reload his buffer when the memory is written into.  In such case this happen in the inline cache of JM because valgrind still run the non patched code.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.