583684 - JM: "Assertion failure: fe->isCopied() && addressOf(fe).offset != to.offset,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function () {
    var b = e
    for (var [e] = b in w) c
})()

asserts js debug shell on JM changeset 2ee92d697741 with -m at Assertion failure: fe->isCopied() && addressOf(fe).offset != to.offset, at ../methodjit/FrameState-inl.h:483

Comment 1

[Andrew Drake [:adrake]]

Bisection results:

Changeset 43593:986b89529822: good
The first bad revision is:                                                                                                                                                                                                                    
changeset:   43594:32aca0384575
user:        David Anderson <[e-mail]>
date:        Sat Jun 12 19:00:30 2010 -0700
summary:     [JAEGER] Added monomorphic inline cache for reads of unbound globals.

Comment 2

[Sean Stangl [:sstangl]]

Attachment: Assert fe->isCopy() implies fe->copyOf()->isCopied().

Adds a new debugging method after assertValidRegisterState() called assertValidFrameState() that verifies the above relationship.

Causes 137 trace-test failures.

The problem is with getgname.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

The problem is that uncopy() is breaking the invariant around lines 884-893 of FrameState.cpp.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 5

[Sean Stangl [:sstangl]]

Comment on attachment 462212 [details] [diff] [review]
fix

Looks good.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/e776df74eaf0

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug583684.js.