Closed
Bug 707141
Opened 13 years ago
Closed 11 years ago
Assertion failure: !a->analysis->trackSlot(entrySlot(fe)), at methodjit/FrameState.cpp:801
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 825966
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update,ignore])
The following test asserts on mozilla-central revision 1b3f17ffa656 (options -m -n -a): function testTableSwitch2() { var arr = []; for (var i = 0; i < 10; ++i) switch (arr[i]) { case 3: case testTableSwitch2, undefined, arr=99999999999, s, this: } } testTableSwitch2();
Reporter | ||
Updated•12 years ago
|
Whiteboard: js-triage-needed → [jsbugmon:update,bisect,bisectfix]
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,bisectfix]
Reporter | ||
Comment 1•12 years ago
|
||
JSBugMon: Bisection requested, failed due to error (try manually).
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,bisect,bisectfix]
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,bisectfix]
Reporter | ||
Comment 2•12 years ago
|
||
JSBugMon: Bisection requested, failed due to error (try manually).
Comment 3•12 years ago
|
||
I made some fixes to autoBisectJs and got the following result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 76518:6e67cafd75c8 user: Jan de Mooij date: Sat Sep 03 22:23:33 2011 +0200 summary: Bug 670493 - Refactor and optimize booleanJumpScript. r=bhackett
Blocks: 670493
Keywords: regression
Reporter | ||
Comment 4•12 years ago
|
||
Retrying with the fix, just to confirm it's working now.
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,bisect]
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 5•12 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 76518:6e67cafd75c8 user: Jan de Mooij date: Sat Sep 03 22:23:33 2011 +0200 summary: Bug 670493 - Refactor and optimize booleanJumpScript. r=bhackett
Reporter | ||
Comment 6•12 years ago
|
||
Horray, thanks gkw :) Jandem, can you look into this once you have time? (IonMonkey is probably more important right now).
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Reporter | ||
Comment 7•11 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 01dcfddcba85).
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,bisectfix]
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,ignore]
Reporter | ||
Comment 8•11 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 01dcfddcba85). JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: 117456:ae47afdbb7d1 user: Jan de Mooij date: Thu Jan 03 18:35:54 2013 +0100 summary: Bug 825966 part 2 - Mark JSOP_CASE/JSOP_DEFAULT targets as safepoint. r=bhackett This iteration took 62.941 seconds to run.
Comment 10•11 years ago
|
||
(In reply to Gary Kwong [:gkw] from comment #9) > jandem, is bug 825966 a possible fix? Likely, but I don't know the code triggering this assert very well, so I'm not completely sure. Can you watch out for similar failures? If you don't see any I'm fine with closing this as duplicate.
Flags: needinfo?(jdemooij)
Comment 11•11 years ago
|
||
See comment 10.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•