741202 - IonMonkey: Assertion failure: NYI, at ion/Lowering.cpp:480

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m):


function check(b, desc) {
    function ownProperties(obj) {
        return Object.getOwnPropertyNames(obj).
            map(function (p) { return [p, Object.getOwnPropertyDescriptor(obj, p)]; });
    }
    function notIndex(p) {
        var u = p >>> 0;
    }
    function assertIsCloneOf(a, b, path) {
        var pa = ownProperties(a);
        var aNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex);
        var bNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex);
    }
    var banner = "while testing clone of " + (desc || uneval(b));
    var a = deserialize(serialize(b));
    var queue = [[a, b, banner]];
    var triple = queue.shift();
    assertIsCloneOf(triple[0], triple[1], triple[2]);
}
check({x: 0.7, p: "forty-two", y: null, z: undefined});
check([0, 1, 2, , 4, 5, 6]);

Comment 1

[Nicolas B. Pierron [:nbp]]

Test ./jit-test/tests/jaeger/bug593554.js fails identically with --ion --ion-eager -n.

Comment 2

[Nicolas B. Pierron [:nbp]]

Attachment: Implement ShiftOp for values operands

Reuse BitOpV LIR, because MShiftOp use the Bitwise policy and as the same signature.

Comment 3

[Jan de Mooij [:jandem]]

A problem with >>> is that it can return double values if the RHS is 0, see this testcase:

function ursh(x, y) { return x >>> y; };
var o = {valueOf: function() { return -0x80000000; }};

for (var i=0; i<70; i++)
    assertEq(ursh(o, 0), 0x80000000);

Comment 4

[Nicolas B. Pierron [:nbp]]

Attachment: Implement ShiftOp for values operands

Use LBinaryV instead of LBitOpV for the Value implementation of Ursh.
- Fix issue in MUrsh::canOverflow (assumed that all constants were int32)
- Fix issue in MIR shift annotations (MLsh, MRsh, MUrsh defined as commutative by MBinaryBitwiseInstruction::infer)

Comment 5

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/projects/ionmonkey/rev/49c6f796e3fc

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug741202.js.