847887 - IonMonkey: Assertion failure: JSOp(*regs.pc) == JSOP_CALL || JSOp(*regs.pc) == JSOP_NEW || JSOp(*regs.pc) == JSOP_FUNAPPLY, at ion/Bailouts.cpp:201

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 015da7030aab (run with --ion-eager):


function eval() { (1, "null")();}
try { eval(null); } catch(exc1) {}
evaluate('eval("var EXP_1 = new MyObject(100); var EXP_2 = new MyObject(\'string\'); EXP_1 + EXP_2")', { noScriptRval : true });

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
Due to skipped revisions, the first bad revision could be any of:
changeset:   122543:5b0002d4b427
user:        Brian Hackett
date:        Thu Feb 21 06:46:46 2013 -0700
summary:     Bug 842424 - Add missing newKind, r=terrence.

changeset:   122544:985efc588a5e
user:        Mark Finkle
date:        Thu Feb 21 08:52:37 2013 -0500
summary:     Bug 843361 - Dump list of open files if we fail to unlock the DB r=blassey

changeset:   122545:cd16203968a5
user:        Brian Hackett
date:        Thu Feb 21 06:54:16 2013 -0700
summary:     Bug 842425 - Watch for arrays that need elements converted to doubles when pushing elements, r=jandem.

changeset:   122546:0ded3af9b2d7
user:        Brian Hackett
date:        Thu Feb 21 06:56:54 2013 -0700
summary:     Bug 743394 - Ion compile JSOP_EVAL, r=jandem.

changeset:   122547:48c067a87ba2
user:        Brian Hackett
date:        Thu Feb 21 07:02:41 2013 -0700
summary:     Bug 842424 - Remove assertion.

This iteration took 28.345 seconds to run.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 126563fd3ba1).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 126563fd3ba1).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   125415:85eca178a678
user:        Brian Hackett
date:        Tue Mar 19 08:50:31 2013 -0600
summary:     Bug 852174 - Fix bogus asserts, r=jandem.

This iteration took 98.298 seconds to run.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This assert was removed in bug 852174 (which is a bug about the same assert), assuming fixed by it.

Comment 5

[Christian Holler (:decoder)]

Original bug is in-testsuite+, not taking this test.