Closed Bug 926904 Opened 11 years ago Closed 11 years ago

Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Modified registers between VM call and OsiPoint)), at jit/shared/CodeGenerator-shared.cpp:532 with --ion-regalloc=backtracking

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla28

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase) 

The following testcase asserts on mozilla-central revision 23bd0deec359 (run with --fuzzing-safe --ion-eager --ion-regalloc=backtracking):


enableOsiPointRegisterChecks();
gczeal(4);
function test() {
  var x = { "0": 3, x: test };
  try {
    if ("-0" in x)
      throw "0 not in x after insertion of 0 property";
    this ["-0"] +=  7;
  } catch(ex) {}
}
test();
test();
Blocks: 826741
This was fixed in 0aeda4bd3113 (bug 936891).
Status: NEW → RESOLVED
Closed: 11 years ago
Depends on: 936891
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Keywords: verifyme
Reproduced with the 10/30 JS shell, verified as fixed with the Fx28.0b3 shell. All I get on the beta shell is "ReferenceError: gczeal is not defined".
Status: RESOLVED → VERIFIED
Keywords: verifyme
Ioana, that just means the beta shell was not a debug build. To verify this, you need a debug build so the gczeal() call works.
Flags: needinfo?(ioana.budnar)
Yeah, that was the problem. I get no errors with the debug beta shell.
Flags: needinfo?(ioana.budnar)
You need to log in before you can comment on or make changes to this bug.