Assertion failure: script->canBaselineCompile(), at jit/BaselineJIT.cpp

RESOLVED FIXED in Firefox 27

Status

()

defect
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks 1 bug, {assertion, regression, testcase})

Trunk
mozilla28
x86_64
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox25 unaffected, firefox26 unaffected, firefox27 fixed, firefox28 fixed, firefox-esr17 unaffected, firefox-esr24 unaffected)

Details

(Whiteboard: [jsbugmon:update][qa-])

Attachments

(3 attachments)

function g() {
    yield
}
g()
function f() {
    g()
}
try {
    new f
} catch (e) {}


asserts js debug shell on m-c changeset 6baab9dc96df with --baseline-eager at Assertion failure: script->canBaselineCompile(), at jit/BaselineJIT.cpp

Tested with:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1382811547/jsshell-mac64.zip

which I presume is a 64-bit debug non-deterministic threadsafe build.
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/cee39f8dc049
parent:      152273:f4bc5478669b
user:        Brian Hackett
date:        Fri Oct 25 14:05:02 2013 -0600
summary:     Bug 928562 - Always eagerly baseline compile inlined scripts during definite properties analysis, r=jandem.

This iteration took 426.038 seconds to run.
Brian, is bug 928562 a likely regressor?
Blocks: 928562
Flags: needinfo?(bhackett1024)
Posted patch patchSplinter Review
Assignee: general → bhackett1024
Attachment #823401 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #823401 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/f283ae025d83
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Do you mind nominating for aurora landing as well please?
Comment on attachment 823401 [details] [diff] [review]
patch

[Approval Request Comment]
User impact if declined: assertion failure
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none
Attachment #823401 - Flags: approval-mozilla-aurora?
Flags: needinfo?(bhackett1024)
Attachment #823401 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Keywords: checkin-needed
Duplicate of this bug: 933222
Component: JavaScript Engine → JavaScript Engine: JIT
https://hg.mozilla.org/mozilla-central/diff/f283ae025d83/js/src/jit-test/tests/ion/bug931496.js
Flags: in-testsuite+
Whiteboard: [jsbugmon:update] → [jsbugmon:update][qa-]
You need to log in before you can comment on or make changes to this bug.