830544 - Assertion failure with enableSPSProfilingAssertions and switch

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js --ion-eager

enableSPSProfilingAssertions(false);

function e(){}

function f(j)
{
    switch (j) {
        case 1:   e(); e(); return;
        default:  print('_'); return;
    }
}

f(1);
f(2);


Assertion failure: frame->script->code <= pc && pc < frame->script->code + frame->script->length, at js/src/vm/SPSProfiler.h:419

If I replace the 'print' call with another 'e' call, I get another assertion:

Assertion failure: frames.length() > 0, at js/src/vm/SPSProfiler.h:328

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   119189:9db432271c1b
user:        Jan de Mooij
date:        Thu Jan 17 21:44:59 2013 +0100
summary:     Bug 830943 - Fix tableswitch block ordering. r=dvander

jandem, is this a likely fix?

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> 
> jandem, is this a likely fix?

Yeah, that seems likely.