Closed Bug 891156 Opened 11 years ago Closed 11 years ago

Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp with ParallelArrays

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(1 file)

Attached file stack
Object.defineProperty(this, "x", {
    get: function() {
        return y.scan(function(a, b) {
            if (a % 6) {
                return (b / b)
            }
        })
    }
});
y = new ParallelArray([3], function() {
    return 0
});
for (var m = 0; m < 9999999; m++) {
    x
}

asserts js debug shell on m-c changeset d87b950c7a6f with --ion-eager --ion-regalloc=backtracking at Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ed26fdbe8444
user:        Shu-yu Guo
date:        Sat May 04 20:53:21 2013 -0700
summary:     Bug 646597 - Make functions made by the Function constructor compile-and-go. Most of patch was originally written by jorendorff. (r=luke)

Shu-yu, is bug 646597 a possible regressor?
Flags: needinfo?(shu)
OS: Mac OS X → All
Hardware: x86_64 → All
I doubt it. That patched enabled more functions to be compiled that weren't being compiled before, but didn't fuss with anything lower level.
Flags: needinfo?(shu)
Setting needinfo from Brian since this involves the backtracking allocator.
Flags: needinfo?(bhackett1024)
This doesn't reproduce for me on x86 or x64.

By the testcase, it looks like it was probably hitting bug 900437, however I don't see a failure even when I disable the fix for that bug, so possibly something else has changed besides.
Also didn't reproduce for me anymore, marking as WFM unless it pops up again or does reproduce for someone else.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
I'll file a new bug should I see this again.
Flags: needinfo?(bhackett1024) → in-testsuite?
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: