797163 - "Assertion failure: lifetime->entry == uint32_t(entryTarget - outerScript->code),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f() {
  switch (2) {
  default:
    y = newGlobal()
  }
  return function(code) {
    try {
      evalcx(code, y)
    } catch (e) {}
  }
}
function h(code) {
  g(code)
}
g = f()
mjitChunkLimit(1)
h("let x=s")
h("switch(x){\
  case 2:break;\
  b;\
  default:while(this){}\
}")

asserts js debug shell on m-c changeset 640a57ebab48 without any CLI arguments at Assertion failure: lifetime->entry == uint32_t(entryTarget - outerScript->code),

s-s because bug 781859 is s-s, also adapting flags from that bug.

This is likely fixed by the upcoming patch in bug 781859, filing to (hopefully) get this testcase in the tree.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 93cc1ee94291).

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 93cc1ee94291).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   111150:0d60a2c574f4
user:        Brian Hackett
date:        Tue Oct 23 07:45:34 2012 -0700
summary:     Don't get confused by unreachable opcodes before loop headers when picking chunk boundaries, bug 781859. r=jandem

This iteration took 204.724 seconds to run.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Highly likely fixed by bug 781859.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 5

[Alex Keybl [:akeybl]]

Matt - can you verify this is fixed in FF17/18 as well? Thanks!

Comment 6

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed assertion on build 2012-10-2, nightly
Verified fixed on build 2012-11-6, nightly
Verified fixed on build 2012-11-6, Aurora 18
Verified fixed on build 2012-11-6, Beta 17

Comment 7

[Christian Holler (:decoder)]

Bug 781859 already has a test, not taking this one.