Closed Bug 950824 Opened 11 years ago Closed 10 years ago

Assertion failure: (uint32_t)(const uint32_t *)val == uint32_t(expectedValue.value), at ../../../js/src/jit/arm/Assembler-arm.cpp:2539 during mochitests on Android 4.0 Debug

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla29

People

(Reporter: gbrown, Assigned: mjrosenb)

References

Details

+++ This bug was initially created as a clone of Bug #940080 +++

Beginning with https://tbpl.mozilla.org/?tree=Cedar&showall=1&rev=f392dbd98567, all of the Android 4.0 Debug mochitests are failing with this assertion.

https://tbpl.mozilla.org/php/getParsedLog.php?id=32035540&tree=Cedar&full=1

1:02:37  WARNING -  PROCESS-CRASH | remoteautomation.py | application crashed [@ js::jit::Assembler::patchDataWithValueCheck(js::jit::CodeLocationLabel, js::jit::PatchedImmPtr, js::jit::PatchedImmPtr)]
11:02:37     INFO -  Crash dump filename: /tmp/tmpkE9I15/78675c39-96b6-a361-26c5a24c-04879e20.dmp
11:02:37     INFO -  Operating system: Android
11:02:37     INFO -                    0.0.0 Linux 3.2.0+ #2 SMP PREEMPT Thu Nov 29 08:06:57 EST 2012 armv7l pandaboard/pandaboard/pandaboard:4.0.4/IMM76I/5:eng/test-keys
11:02:37     INFO -  CPU: arm
11:02:37     INFO -       0 CPUs
11:02:37     INFO -  Crash reason:  SIGSEGV
11:02:37     INFO -  Crash address: 0x0
11:02:37     INFO -  Thread 13 (crashed)
11:02:37     INFO -   0  libxul.so!js::jit::Assembler::patchDataWithValueCheck(js::jit::CodeLocationLabel, js::jit::PatchedImmPtr, js::jit::PatchedImmPtr) [Assembler-arm.cpp:f392dbd98567 : 2539 + 0x14]
11:02:37     INFO -       r4 = 0x6caf3ac0    r5 = 0x6a324000    r6 = 0xffffffff    r7 = 0x00000027
11:02:37     INFO -       r8 = 0x5d3ff470    r9 = 0x6cfe8700   r10 = 0x6cfe8910    fp = 0x00000002
11:02:37     INFO -       sp = 0x5d3ff3b0    lr = 0x62d74701    pc = 0x62d77456
11:02:37     INFO -      Found by: given as instruction pointer in context
11:02:37     INFO -   1  libxul.so!js::jit::Assembler::patchDataWithValueCheck(js::jit::CodeLocationLabel, js::jit::ImmPtr, js::jit::ImmPtr) [Assembler-arm.cpp:f392dbd98567 : 2552 + 0x7]
11:02:37     INFO -       r4 = 0x5d3ff3e0    r5 = 0x6a324000    r6 = 0x662ac8d0    r7 = 0x00000027
11:02:37     INFO -       r8 = 0x5d3ff470    r9 = 0x6cfe8700   r10 = 0x6cfe8910    fp = 0x00000002
11:02:37     INFO -       sp = 0x5d3ff3e0    pc = 0x62d7747b
11:02:37     INFO -      Found by: call frame info
11:02:37     INFO -   2  libxul.so!js::jit::CodeGenerator::link(JSContext*, js::types::CompilerConstraintList*) [CodeGenerator.cpp:f392dbd98567 : 6072 + 0x3]
11:02:37     INFO -       r4 = 0x6abf35d0    r5 = 0x6a324000    r6 = 0x662ac8d0    r7 = 0x00000027
11:02:37     INFO -       r8 = 0x5d3ff470    r9 = 0x6cfe8700   r10 = 0x6cfe8910    fp = 0x00000002
11:02:37     INFO -       sp = 0x5d3ff3f0    pc = 0x63044c7f
11:02:37     INFO -      Found by: call frame info
11:02:37     INFO -   3  libxul.so!js::jit::AttachFinishedCompilations(JSContext*) [Ion.cpp:f392dbd98567 : 1558 + 0xb]
11:02:37     INFO -       r4 = 0x6abf35d0    r5 = 0x6b85c820    r6 = 0x6ccf0180    r7 = 0x5d3ff53c
11:02:37     INFO -       r8 = 0x65c27000    r9 = 0x6cfe7000   r10 = 0x00000001    fp = 0x5d3ff528
11:02:37     INFO -       sp = 0x5d3ff4e0    pc = 0x62caeda7
11:02:37     INFO -      Found by: call frame info
11:02:37     INFO -   4  libxul.so!js_InvokeOperationCallback(JSContext*) [jscntxt.cpp:f392dbd98567 : 1029 + 0x5]
11:02:37     INFO -       r4 = 0x65c27000    r5 = 0x00000000    r6 = 0x6abf35d0    r7 = 0x5bd44100
11:02:37     INFO -       r8 = 0x5d310001    r9 = 0x6baf8318   r10 = 0x00000003    fp = 0x5d3ff65c
11:02:37     INFO -       sp = 0x5d3ff590    pc = 0x62dc31d9
11:02:37     INFO -      Found by: call frame info

11:02:40     INFO -  12-16 11:02:00.523 D/GeckoBrowserApp( 2224): BrowserApp.onTabChanged: 0: STOP
11:02:40     INFO -  12-16 11:02:00.531 E/LoadFaviconTask( 2224): Error reading favicon
11:02:40     INFO -  12-16 11:02:00.531 E/LoadFaviconTask( 2224): Error reading favicon
11:02:40     INFO -  12-16 11:02:00.562 D/GeckoToolbar( 2224): onTabChanged: FAVICON
11:02:40     INFO -  12-16 11:02:00.562 D/GeckoToolbar( 2224): setFavicon(android.graphics.Bitmap@41251590)
11:02:40     INFO -  12-16 11:02:00.562 D/GeckoBrowserApp( 2224): BrowserApp.onTabChanged: 0: FAVICON
11:02:40     INFO -  12-16 11:02:00.640 E/Profiler( 2224): BPUnw: [8 total] thread_register_for_profiling(me=0x10aafe0, stacktop=0x6c6ffdb3)
11:02:40     INFO -  12-16 11:02:01.000 D/GeckoThumbnailHelper( 2224): Using new thumbnail size: 58240 (width 160)
11:02:40     INFO -  12-16 11:02:01.000 D/GeckoThumbnailHelper( 2224): Sending thumbnail event: 160, 91
11:02:40     INFO -  12-16 11:02:02.250 F/MOZ_Assert( 2224): Assertion failure: (uint32_t)(const uint32_t *)val == uint32_t(expectedValue.value), at ../../../js/src/jit/arm/Assembler-arm.cpp:2539
Happens to me when going to bing.com on a Nexus 4 using a debug build.
OS: Mac OS X → Android
Hardware: x86 → ARM
See bug 951573 which has a testcase - it might be related.
See Also: → 951573
Recent builds on Cedar no longer have this problem.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
I'd say FIXED by bug 951573. (similar assert)
Resolution: WORKSFORME → FIXED
Assignee: nobody → mrosenberg
Depends on: 951573
Target Milestone: --- → mozilla29
You need to log in before you can comment on or make changes to this bug.