Last Comment Bug 731826 - IonMonkey: Assertion failure: tag <= CalleeToken_Script, at ../../ion/IonFrames.h:70
: IonMonkey: Assertion failure: tag <= CalleeToken_Script, at ../../ion/IonFram...
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
-- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
  Show dependency treegraph
Reported: 2012-02-29 15:24 PST by Hannes Verschore [:h4writer]
Modified: 2012-04-04 19:21 PDT (History)
0 users
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

crypto.js.reduced (703 bytes, text/plain)
2012-02-29 15:24 PST, Hannes Verschore [:h4writer]
no flags Details
crypto.js.extra.reduced (284 bytes, application/javascript)
2012-03-01 03:42 PST, Hannes Verschore [:h4writer]
no flags Details

Description User image Hannes Verschore [:h4writer] 2012-02-29 15:24:29 PST
Created attachment 601794 [details]

This happens on a reduced and modified version of v8/crypto.js. See attachment for testcase.
Running on "--ion -n -m"

Assertion failure: tag <= CalleeToken_Script, at /home/h4writer/Build/ionmonkey/js/src/ion/IonFrames.h:70

Program received signal SIGABRT, Aborted.
0xf7fdd430 in __kernel_vsyscall ()
(gdb) bt
#0  0xf7fdd430 in __kernel_vsyscall ()
#1  0xf7fa8ebe in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#2  0x08442856 in MOZ_Crash () at /home/h4writer/Build/ionmonkey/mfbt/Assertions.cpp:79
#3  0x084428b2 in MOZ_Assert (s=0x8502072 "tag <= CalleeToken_Script", 
    file=0x850203c "/home/h4writer/Build/ionmonkey/js/src/ion/IonFrames.h", ln=70)
    at /home/h4writer/Build/ionmonkey/mfbt/Assertions.cpp:88
#4  0x083b64e2 in js::ion::GetCalleeTokenTag (token=0x6ede28f7)
    at /home/h4writer/Build/ionmonkey/js/src/ion/IonFrames.h:70
#5  0x083b66be in js::ion::MaybeScriptFromCalleeToken (token=0x6ede28f7)
    at /home/h4writer/Build/ionmonkey/js/src/ion/IonFrames.cpp:60
#6  0x083b6be2 in js::ion::IonFrameIterator::script (this=0xffffc378)
    at /home/h4writer/Build/ionmonkey/js/src/ion/IonFrames.cpp:212
#7  0x0838526c in InvalidateActivation (cx=0x86dbe08, ionTop=0xffffc5e0 "8", invalidateAll=false)
    at /home/h4writer/Build/ionmonkey/js/src/ion/Ion.cpp:1018
#8  0x083856fd in js::ion::Invalidate (cx=0x86dbe08, invalid=..., resetUses=true)
    at /home/h4writer/Build/ionmonkey/js/src/ion/Ion.cpp:1122
#9  0x08119f16 in js::types::TypeCompartment::processPendingRecompiles (this=0x86dc6b8, cx=0x86dbe08)
    at /home/h4writer/Build/ionmonkey/js/src/jsinfer.cpp:2148
#10 0x080a4aaf in js::types::AutoEnterTypeInference::~AutoEnterTypeInference (this=0xffffc4c0, 
    __in_chrg=<optimized out>) at ../jsinferinlines.h:235
#11 0x08123130 in js::types::TypeMonitorResult (cx=0x86dbe08, script=0xf7306258, pc=0x86e4dbc "5", 
    rval=...) at /home/h4writer/Build/ionmonkey/js/src/jsinfer.cpp:5160
#12 0x08152ef5 in js::types::TypeScript::Monitor (cx=0x86dbe08, script=0xf7306258, pc=0x86e4dbc "5", 
    rval=...) at ../jsinferinlines.h:575
#13 0x0845cefe in js::ion::InvalidationBailout (sp=0xffffc598, frameSizeOut=0xffffc594)
    at /home/h4writer/Build/ionmonkey/js/src/ion/Bailouts.cpp:451
Comment 1 User image Hannes Verschore [:h4writer] 2012-03-01 03:42:52 PST
Created attachment 601921 [details]

I could reduce this .js file even more. The crash signature is now switching between the backtrace listed here and the one in bug #731820. (Under gdb it is only possible to get the backtrace listed in this file)

configure: debug enabled, 32bit
args: "--ion -n -m" 
revision: 89040:7d6da2d65595
Comment 2 User image Hannes Verschore [:h4writer] 2012-04-04 19:21:05 PDT
Doesn't fail on tip anymore. As testcase is very similar to bug #731820, I assume it was fixed on the same revision. That's also the reason I'm not adding this testcase. If somebody thinks differently, let me know and I'll add the testcase.

Note You need to log in before you can comment on or make changes to this bug.