Closed Bug 741110 Opened 13 years ago Closed 12 years ago

Assertion failure: lifetime && lifetime->head == uint32_t(head - outerScript->code) && lifetime->entry == uint32_t(entryTarget - outerScript->code), at methodjit/LoopState.cpp:111

Categories

(Core :: JavaScript Engine, defect)

x86_64
All
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 781859
Tracking Status
firefox14 --- affected
firefox15 --- affected
firefox16 --- affected
firefox17 --- affected
firefox18 --- affected
firefox-esr10 --- unaffected

People

(Reporter: decoder, Assigned: Waldo)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: js-triage-needed [jsbugmon:update])

The following test asserts on mozilla-central revision 92fe907ddac8 (options -m -n -a): mjitChunkLimit(10); function e() { try { var t = undefined; } catch (e) { } while (t) continue; } for (var i = 0; i < 20; i++) e(); Making this s-s because there has been a previous bug with this assert that was s-s and mjit chunking bugs are likely to be s-s too.
Is this a regression from chunked compilation landing, or a later regression?
Whiteboard: js-triage-needed → js-triage-needed [jsbugmon:update,reconfirm]
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision e4f9e2eab6b1+).
Whiteboard: js-triage-needed [jsbugmon:update,reconfirm] → js-triage-needed [jsbugmon:update,reconfirm,ignore]
(In reply to David Mandelin from comment #1) > Is this a regression from chunked compilation landing, or a later regression? Regression from chunked compilation landing: The first bad revision is: changeset: 87165:3b8ad7252ccb user: Brian Hackett date: Sat Feb 18 08:52:04 2012 -0800 summary: Enable chunked compilation on x64, bug 728372. r=dvander
Keywords: regression
Assignee: general → bhackett1024
Blocks: 728372
Another testcase found by jsfunfuzz: mjitChunkLimit(42); Function("\ switch (/x/) {\ case 8:\ break;\ t(function(){})\ }\ while (false)(function(){})\ ")() Tested on m-c changeset 3be950fe9e1e with -m, -n and -a.
OS: Linux → All
Comment 4 (through autoBisect) points to bug 720316 as the regressing changeset instead, so I spun that testcase into bug 770089.
Whiteboard: js-triage-needed [jsbugmon:update,reconfirm,ignore] → js-triage-needed [jsbugmon:update]
Brian, any updates here?
Assigning to Jeff to complete the bug trifecta.
Assignee: bhackett1024 → jwalden+bmo
Patches in bug 781859 fix this.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.