741110 - Assertion failure: lifetime && lifetime->head == uint32_t(head - outerScript->code) && lifetime->entry == uint32_t(entryTarget - outerScript->code), at methodjit/LoopState.cpp:111

Status: RESOLVED DUPLICATE of bug 781859

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 92fe907ddac8 (options -m -n -a):


mjitChunkLimit(10);
function e() {
    try {
        var t = undefined;
    } catch (e) { }
    while (t)
        continue;
}
for (var i = 0; i < 20; i++)
  e();


Making this s-s because there has been a previous bug with this assert that was s-s and mjit chunking bugs are likely to be s-s too.

Comment 1

[David Mandelin [:dmandelin]]

Is this a regression from chunked compilation landing, or a later regression?

Comment 2

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision e4f9e2eab6b1+).

Comment 3

[Christian Holler (:decoder)]

(In reply to David Mandelin from comment #1)
> Is this a regression from chunked compilation landing, or a later regression?

Regression from chunked compilation landing:

The first bad revision is:
changeset:   87165:3b8ad7252ccb
user:        Brian Hackett
date:        Sat Feb 18 08:52:04 2012 -0800
summary:     Enable chunked compilation on x64, bug 728372. r=dvander

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another testcase found by jsfunfuzz:

mjitChunkLimit(42);
Function("\
    switch (/x/) {\
        case 8:\
        break;\
        t(function(){})\
    }\
    while (false)(function(){})\
")()

Tested on m-c changeset 3be950fe9e1e with -m, -n and -a.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment 4 (through autoBisect) points to bug 720316 as the regressing changeset instead, so I spun that testcase into bug 770089.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases in comment 0 and comment 4 still assert with http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-08-09-mozilla-central-debug/jsshell-mac64.zip

Comment 7

[Al Billings [:abillings - ex-MoCo]]

Brian, any updates here?

Comment 8

[David Bolter [:davidb] (NeedInfo me for attention)]

Assigning to Jeff to complete the bug trifecta.

Comment 9

[Jan de Mooij [:jandem]]

Patches in bug 781859 fix this.