Closed Bug 707141 Opened 13 years ago Closed 11 years ago

Assertion failure: !a->analysis->trackSlot(entrySlot(fe)), at methodjit/FrameState.cpp:801

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 825966

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update,ignore])

The following test asserts on mozilla-central revision 1b3f17ffa656 (options -m -n -a):


function testTableSwitch2() {
    var arr = [];
    for (var i = 0; i < 10; ++i) 
    switch (arr[i]) {
        case 3:
        case testTableSwitch2, undefined, arr=99999999999, s, this:
    }
}
testTableSwitch2();
Whiteboard: js-triage-needed → [jsbugmon:update,bisect,bisectfix]
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,bisectfix]
JSBugMon: Bisection requested, failed due to error (try manually).
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,bisect,bisectfix]
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,bisectfix]
JSBugMon: Bisection requested, failed due to error (try manually).
I made some fixes to autoBisectJs and got the following result:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   76518:6e67cafd75c8
user:        Jan de Mooij
date:        Sat Sep 03 22:23:33 2011 +0200
summary:     Bug 670493 - Refactor and optimize booleanJumpScript. r=bhackett
Blocks: 670493
Keywords: regression
Retrying with the fix, just to confirm it's working now.
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   76518:6e67cafd75c8
user:        Jan de Mooij
date:        Sat Sep 03 22:23:33 2011 +0200
summary:     Bug 670493 - Refactor and optimize booleanJumpScript. r=bhackett
Horray, thanks gkw :)

Jandem, can you look into this once you have time? (IonMonkey is probably more important right now).
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 01dcfddcba85).
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,bisectfix]
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 01dcfddcba85).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   117456:ae47afdbb7d1
user:        Jan de Mooij
date:        Thu Jan 03 18:35:54 2013 +0100
summary:     Bug 825966 part 2 - Mark JSOP_CASE/JSOP_DEFAULT targets as safepoint. r=bhackett

This iteration took 62.941 seconds to run.
jandem, is bug 825966 a possible fix?
Flags: needinfo?(jdemooij)
(In reply to Gary Kwong [:gkw] from comment #9)
> jandem, is bug 825966 a possible fix?

Likely, but I don't know the code triggering this assert very well, so I'm not completely sure. Can you watch out for similar failures? If you don't see any I'm fine with closing this as duplicate.
Flags: needinfo?(jdemooij)
See comment 10.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.