Closed Bug 1008106 Opened 6 years ago Closed 6 years ago

Assertion failure: lower_ == ((int32_t)0x80000000), at jit/RangeAnalysis.h

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

All
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla32

People

(Reporter: gkw, Assigned: sunfish)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update,origRev=5700a88f895f])

Attachments

(2 files)

Attached file stack
(function() {
    "use asm";
    (4 ? 6976294838210000 : 0) < (18446744073709552000 / 8589934593) ? 5 : e
})()

asserts js debug shell on m-c changeset 5700a88f895f with --ion-parallel-compile=off --ion-eager at Assertion failure: lower_ == ((int32_t)0x80000000), at jit/RangeAnalysis.h

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-inbound/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

Tested to also happen with 64-bit shells (which is what I used to run autoBisect).

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/42a20a0d4269
user:        Dan Gohman
date:        Tue Oct 15 20:49:44 2013 -0700
summary:     Bug 918607 - IonMonkey: Add a Range::setDouble which takes double arguments and use it to simplify and generalize several things.

Dan, is bug 918607 a likely regressor?
Flags: needinfo?(sunfish)
Whiteboard: [jsbugmon:update] → [jsbugmon:]
JSBugMon: Cannot process bug: Error: Failed to compile specified revision 697629483821 (maybe try another?)
> asserts js debug shell on m-c changeset 5700a88f895f with

D'oh, I was testing on mozilla-inbound then, so it should be on m-c now. Retrying w/JSBugMon now.
Whiteboard: [jsbugmon:] → [jsbugmon:update]
Whiteboard: [jsbugmon:update] → [jsbugmon:]
JSBugMon: Cannot process bug: Error: Failed to compile specified revision 697629483821 (maybe try another?)
Whiteboard: [jsbugmon:] → [jsbugmon:update,origRev=5700a88f895f]
When refineInt32BoundsByExponent tightens the upper or lower bounds, it also needs to set the hasInt32UpperBound and hasInt32LowerBound flags.
Assignee: nobody → sunfish
Attachment #8420270 - Flags: review?(nicolas.b.pierron)
Flags: needinfo?(sunfish)
Attachment #8420270 - Flags: review?(nicolas.b.pierron) → review+
https://hg.mozilla.org/mozilla-central/rev/d6bd79de08f4
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
You need to log in before you can comment on or make changes to this bug.