931496 - Assertion failure: script->canBaselineCompile(), at jit/BaselineJIT.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack without symbols

function g() {
    yield
}
g()
function f() {
    g()
}
try {
    new f
} catch (e) {}


asserts js debug shell on m-c changeset 6baab9dc96df with --baseline-eager at Assertion failure: script->canBaselineCompile(), at jit/BaselineJIT.cpp

Tested with:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1382811547/jsshell-mac64.zip

which I presume is a 64-bit debug non-deterministic threadsafe build.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/cee39f8dc049
parent:      152273:f4bc5478669b
user:        Brian Hackett
date:        Fri Oct 25 14:05:02 2013 -0600
summary:     Bug 928562 - Always eagerly baseline compile inlined scripts during definite properties analysis, r=jandem.

This iteration took 426.038 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, is bug 928562 a likely regressor?

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 4

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f283ae025d83

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/f283ae025d83

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Do you mind nominating for aurora landing as well please?

Comment 7

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 8

[Brian Hackett [Laid off!]]

Comment on attachment 823401 [details] [diff] [review]
patch

[Approval Request Comment]
User impact if declined: assertion failure
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d042a03e7087

Comment 11

[Ioana (away)]

https://hg.mozilla.org/mozilla-central/diff/f283ae025d83/js/src/jit-test/tests/ion/bug931496.js