Last Comment Bug 694210 - Assertion failure: UINT32_MAX - startingIndex >= count, at jsarray.cpp:2711
: Assertion failure: UINT32_MAX - startingIndex >= count, at jsarray.cpp:2711
Status: RESOLVED FIXED
[js-triage-done]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla10
Assigned To: Jeff Walden [:Waldo] (remove +bmo to email)
:
Mentors:
Depends on:
Blocks: 668024
  Show dependency treegraph
 
Reported: 2011-10-12 17:23 PDT by Christian Holler (:decoder)
Modified: 2011-10-20 03:06 PDT (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (2.74 KB, patch)
2011-10-18 19:01 PDT, Jeff Walden [:Waldo] (remove +bmo to email)
bhackett1024: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-10-12 17:23:17 PDT
It seems that the fix made in bug 668024 has regressed the test at js/src/tests/ecma_3/Array/regress-322135-03.js

Running that test manually on 64 bit (m-c rev 866b2b1793cd) instantly gives me:

Assertion failure: UINT32_MAX - startingIndex >= count, at jsarray.cpp:2711
Comment 1 Jeff Walden [:Waldo] (remove +bmo to email) 2011-10-12 17:25:38 PDT
This is an easy fix, just return false if that condition doesn't hold.

I was attempting to understand both this and the Kraken regression before posting patches/comments on further changes.  I'm happy to just do this one-off first if it matters much, but if no one's too put out I'll probably wait until I figure out the Kraken problem and write a fix for it.
Comment 2 Jeff Walden [:Waldo] (remove +bmo to email) 2011-10-18 17:27:11 PDT
As far as the kraken regression goes, it looks like it's because all the incoming arrays that are being spliced aren't marked as packed.  Perhaps that could be improved.  Or perhaps not.

However, this seems like a reasonable demonstration that my way to address bug 690622 as applied to splice -- that splicing elements didn't update in-progress enumerators -- is too narrowly focused to preserve the fast-case algorithm for sufficiently much code.  I guess I'll hack around this some other way, then.
Comment 3 Jeff Walden [:Waldo] (remove +bmo to email) 2011-10-18 19:01:04 PDT
Created attachment 567953 [details] [diff] [review]
Patch

It turns out we have a type flag for objects being iterated over, which is equally usable as a condition for determining whether optimization is possible.  Win!
Comment 4 Jeff Walden [:Waldo] (remove +bmo to email) 2011-10-18 19:08:57 PDT
And yes, I did kraken this, with these results for the change immediately before bug 668024, the change made by bug 668024, and that change plus this patch:

[jwalden@wheres-wally kraken]$ tail -n 10 /tmp/unmod.txt && tail -n 10 /tmp/mod.txt && tail -n 10 /tmp/mod-fixed.txt ===============================================
RESULTS (means and 95% confidence intervals)
-----------------------------------------------
Total:                        334.9ms +/- 4.2%
-----------------------------------------------

  stanford:                   334.9ms +/- 4.2%
    crypto-sha256-iterative:  334.9ms +/- 4.2%

Results are located at kraken-1.1-results/sunspider-results-2011-10-18-18.51.36.js
===============================================
RESULTS (means and 95% confidence intervals)
-----------------------------------------------
Total:                        434.4ms +/- 6.2%
-----------------------------------------------

  stanford:                   434.4ms +/- 6.2%
    crypto-sha256-iterative:  434.4ms +/- 6.2%

Results are located at kraken-1.1-results/sunspider-results-2011-10-18-18.49.49.js
===============================================
RESULTS (means and 95% confidence intervals)
-----------------------------------------------
Total:                        332.1ms +/- 2.1%
-----------------------------------------------

  stanford:                   332.1ms +/- 2.1%
    crypto-sha256-iterative:  332.1ms +/- 2.1%

Results are located at kraken-1.1-results/sunspider-results-2011-10-18-18.48.37.js
Comment 5 Jeff Walden [:Waldo] (remove +bmo to email) 2011-10-19 14:11:34 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/5b13e63313a8
Comment 6 Marco Bonardo [::mak] 2011-10-20 03:06:03 PDT
https://hg.mozilla.org/mozilla-central/rev/5b13e63313a8

Note You need to log in before you can comment on or make changes to this bug.