717251 - Assertion failure: js_CodeSpec[*(regs.pc)].format & ((1U<<5) | (2U<<5)), at js/src/jsinterp.cpp:1275

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 4de07a341aab (options -m -n -a):

this.__proto__ = []; 
var msPerDay =   86400000;
for ( var time = 0, year = 1969; year >= 0; year-- ) {
  time -= TimeInYear(year);
}
function DaysInYear( y ) {}
function TimeInYear( y ) {
  return ( DaysInYear(y) * msPerDay );
}


Could be related to bug

Comment 1

[Christian Holler (:decoder)]

That's supposed to say bug 717249 in the end.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I reproduced this too, on m-c changeset 7c7d2a8db7ff but only when passed in as a CLI argument.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This has not been fixed on m-c changeset 7c7d2a8db7ff (which has bug 716713 included)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   84036:7ab4f1ebc7cc
user:        Brian Hackett
date:        Mon Jan 09 06:29:50 2012 -0800
summary:     Backout 54cd89b0f1fa (bug 712714 backout).  Talos will probably report fake regressions for this patch, do not back out for this reason.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

Various problems with AssertValidPropertyCacheHit.  Before bug 712714, I don't think this function was ever being called on cache hits under method JIT stub calls, and now that it is there are a bunch of test failures because of problems in this code.

These test failures weren't showing up on tinderbox because the property cache is disabled in threadsafe builds.  There isn't any technical reason anymore why the property cache should be disabled in such builds, and I tried doing this for bug 712714 but ran into problems because the assertions are broken when dealing with certain DOM objects (there is a cache hit on the prototype, and when confirming the hit a resolve hook on the object itself executes which installs the searched-for property).

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d7abb1f2efc8

Comment 6

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/d7abb1f2efc8

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929