TI: "Assertion failure: getCode(offset).loop," with trap

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla11
x86
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 578781 [details]
stack with dis() information

function f() {
    do {
        return
    } while (e)
}
dis(f)
trap(f, 1, '')
f()

asserts js debug shell on m-c changeset 6180c68bffbf with -m, -a, -n and -d at Assertion failure: getCode(offset).loop,
(Reporter)

Comment 1

6 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81128:d32ccb2b8a05
user:        Brian Hackett
date:        Thu Dec 01 15:13:51 2011 -0800
summary:     Remove JSOP_NOTRACE, rename JSOP_TRACE -> JSOP_LOOPHEAD, bug 706611. r=dvander
Blocks: 706611
(Reporter)

Updated

6 years ago
Keywords: regression
(Assignee)

Comment 2

6 years ago
Created attachment 579856 [details] [diff] [review]
patch

One of the test changes in bug 706611 was incorrect, the compiler needs to check that a loop head has a reachable backedge before compiling it as a loop.
Assignee: general → bhackett1024
Attachment #579856 - Flags: review?(dvander)
Attachment #579856 - Flags: review?(dvander) → review+
(Assignee)

Comment 3

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/7769ec8647b9

Comment 4

6 years ago
https://hg.mozilla.org/mozilla-central/rev/7769ec8647b9
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla11
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug707384.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.