757530 - "Assertion failure: shape_,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming attached testcase asserts js debug shell on m-c changeset 64187d60fae7 with -m and -n at Assertion failure: shape_,

s-s because there seems to be weird jit memory addresses on the stack, just-in-case.

The testcase is fairly fragile so a bisection range won't likely be accurate.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Asserts with m-c changeset 64187d60fae7 but not with 1987beeb0038.

Fix window:

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=64187d60fae7&tochange=1987beeb0038

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Likely fixed by bug 755639:

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   94546:ce618ce8d84a
user:        Brian Hackett
date:        Mon May 21 20:34:22 2012 -0700
summary:     Throw on incompatible calls to gcPreserveCode() and mjitChunkLimit(), bug 755639. r=dvander

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 5

[Daniel Veditz [:dveditz]]

no mjitChunkLimit on ESR

Comment 6

[Jesse Ruderman]

(More precisely, no mjit chunking on ESR.  Chunking was added in bug 706914 along with the testing function mjitChunkLimit.)

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Large fragile testcase -> in-testsuite-