Last Comment Bug 748071 - IonMonkey: "Assertion failure: !"Need to determine correct offsets for generateEnterJIT() args on Win64.","
: IonMonkey: "Assertion failure: !"Need to determine correct offsets for genera...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Windows 7
: -- critical (vote)
: ---
Assigned To: Sean Stangl [:sstangl]
:
Mentors:
Depends on:
Blocks: jsfunfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-04-23 12:53 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-09-17 01:24 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (92.74 KB, text/plain)
2012-04-23 12:53 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Remove assertion. (908 bytes, patch)
2012-04-23 17:57 PDT, Sean Stangl [:sstangl]
marty.rosenberg: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-04-23 12:53:34 PDT
Created attachment 617603 [details]
stack

Object.defineProperty(this, "x", {
  get: function() {
    return x
  }
})
x

asserts js debug shell on IonMonkey changeset 9e64f779b611 without any CLI flags at Assertion failure: !"Need to determine correct offsets for generateEnterJIT() args on Win64.",

First 64-bit Windows bug!
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-04-23 16:34:38 PDT
This has been happening at least since:

http://hg.mozilla.org/projects/ionmonkey/rev/43b55878da46

and probably has existed since IonMonkey creation.
Comment 2 Sean Stangl [:sstangl] 2012-04-23 16:40:30 PDT
It was introduced by Bug 723333. I need access to a Win64 box to verify the right argument offsets in ion/x64/Trampoline-x64.cpp:72-73.
Comment 3 Sean Stangl [:sstangl] 2012-04-23 17:57:39 PDT
Created attachment 617718 [details] [diff] [review]
Remove assertion.

After time spent learning Win64 debug tools with Gary's help, it turns out that the guessed values are actually valid. So we can just remove the assertion.
Comment 4 Sean Stangl [:sstangl] 2012-04-23 18:03:04 PDT
Comment on attachment 617718 [details] [diff] [review]
Remove assertion.

mjrosenb offered a review, so I'm taking it!
Comment 5 Sean Stangl [:sstangl] 2012-04-23 18:05:02 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/ff010cbbec12

Note You need to log in before you can comment on or make changes to this bug.