947070 - Assertion failure: containsPC(pc), at jsscript.h

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

enableSPSProfilingAssertions(true);
function f() {
    (function() {
        for (var i = 0; i < 9; i++) {}
    })();
    f();
    for (var i = 0; i < 9; i++) {}
}
f()

asserts js debug shell on m-c changeset 526e12792fc8 without any CLI arguments at Assertion failure: containsPC(pc), at jsscript.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --disable-threadsafe

s-s because Kannan mentioned before that SPS bugs can be bad. Setting needinfo as well.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(note to self: For now, stick a "Random.init()" line before all the FRC lines, the next time we have to use output from setting dumpEachSeed to true.)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9c90bda44992
user:        Brian Hackett
date:        Thu Aug 15 07:33:30 2013 -0700
summary:     Bug 864220 - Use mprotect to trigger interrupts in Ion compiled code, r=luke,jandem.

Is bug 864220 a likely regressor?

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Andrew McCreight [:mccr8]]

Setting as moderate because it looks related to the profiler.

Comment 5

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 6

[Sean Stangl [:sstangl]]

It looks like this may have been fixed.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/39219e33ec40
user:        Kannan Vijayan
date:        Mon Dec 09 10:28:58 2013 -0500
summary:     Bug 834678 - Ensure correct update of lastPC_ for MInstructions which add OOL code. r=jandem

This issue seems to be gone. Kannan, is bug 834678 a likely fix?

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Kannan mentions in-person here at the JS work week that this is a likely fix.

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.