1022321 - Assertion failure: !unreachable_, at jit/MIRGraph.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f(y) {
    (y | 0) > ~y ? y : y
}
for (var j = 0; j < 1; j++) {
    try {
        f(-2147483648)
    } catch (e) {}
}

asserts js debug shell on m-c changeset 62d33e3ba514 with --ion-parallel-compile=off --ion-eager --ion-gvn=off at Assertion failure: !unreachable_, at jit/MIRGraph.h

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140604070719" and the hash "db41d0ff0c62".
The "bad" changeset has the timestamp "20140604074615" and the hash "51b269a9c5c9".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=db41d0ff0c62&tochange=51b269a9c5c9

Setting s-s and assuming sec-critical because MIR is involved.

Dan, is bug 1004363 a likely regressor?

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Dan Gohman [:sunfish]]

Confirmed. This is an overzealous assert, so it doesn't need to be s-s.

Comment 3

[Dan Gohman [:sunfish]]

Attachment: gvn-unreachable-unchecked.patch

The attached patch fixes it by disabling the assert.

When there are multiple beta nodes in a block, they can each independently discover that the block is unreachable.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Dan Gohman [:sunfish] from comment #2)
> Confirmed. This is an overzealous assert, so it doesn't need to be s-s.

Opening up.

Comment 5

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4ae414acf581

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/4ae414acf581