Last Comment Bug 707384 - TI: "Assertion failure: getCode(offset).loop," with trap
: TI: "Assertion failure: getCode(offset).loop," with trap
Status: RESOLVED FIXED
js-triage-needed
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: mozilla11
Assigned To: Brian Hackett (:bhackett)
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz 706611
  Show dependency treegraph
 
Reported: 2011-12-02 17:24 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:41 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack with dis() information (5.41 KB, text/plain)
2011-12-02 17:24 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
patch (2.16 KB, patch)
2011-12-07 15:07 PST, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-12-02 17:24:07 PST
Created attachment 578781 [details]
stack with dis() information

function f() {
    do {
        return
    } while (e)
}
dis(f)
trap(f, 1, '')
f()

asserts js debug shell on m-c changeset 6180c68bffbf with -m, -a, -n and -d at Assertion failure: getCode(offset).loop,
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-12-02 17:56:01 PST
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81128:d32ccb2b8a05
user:        Brian Hackett
date:        Thu Dec 01 15:13:51 2011 -0800
summary:     Remove JSOP_NOTRACE, rename JSOP_TRACE -> JSOP_LOOPHEAD, bug 706611. r=dvander
Comment 2 Brian Hackett (:bhackett) 2011-12-07 15:07:46 PST
Created attachment 579856 [details] [diff] [review]
patch

One of the test changes in bug 706611 was incorrect, the compiler needs to check that a loop head has a reachable backedge before compiling it as a loop.
Comment 3 Brian Hackett (:bhackett) 2011-12-08 08:57:48 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/7769ec8647b9
Comment 4 Ed Morley [:emorley] 2011-12-09 07:06:11 PST
https://hg.mozilla.org/mozilla-central/rev/7769ec8647b9
Comment 5 Christian Holler (:decoder) 2013-01-14 08:41:59 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug707384.js.

Note You need to log in before you can comment on or make changes to this bug.