Closed Bug 1059606 Opened 5 years ago Closed 5 years ago

OdinMonkey: Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla34
Tracking Status
firefox34 --- affected

People

(Reporter: gkw, Assigned: bbouvier)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker][jsbugmon:update])

Attachments

(1 file)

(function(stdlib) {
    "use asm"
    var abs = stdlib.Math.abs
    function f() {
        return
        (abs(0) | 0)
    }
})()

asserts js debug shell on m-c changeset 7bd309e55a3d with --no-baseline --no-ion --no-threads at Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140827030629" and the hash "e2eda589ea8d".
The "bad" changeset has the timestamp "20140827032329" and the hash "d3f44966d998".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e2eda589ea8d&tochange=d3f44966d998

Benjamin, not sure which bug in that window is related, but setting needinfo? and I'm getting a smaller regression window soon.

This has blown up the fuzzers.
Flags: needinfo?(benj)
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/684b02de6a31
user:        Benjamin Bouvier
date:        Wed Aug 27 12:20:14 2014 +0200
summary:     Bug 1052325: AsmJS: make return coercion optional for standard math lib functions calls; r=luke
Blocks: 1052325
Summary: Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp → OdinMonkey: Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp
Attached patch bug1059606.patchSplinter Review
Thanks for the test case! The assertion is bogus if we're in dead code (which is not obvious in the original test case: the \n after the empty line triggers ASI and thus the next line gets in dead code)
Assignee: nobody → benj
Status: NEW → ASSIGNED
Attachment #8480406 - Flags: review?(luke)
Flags: needinfo?(benj)
Comment on attachment 8480406 [details] [diff] [review]
bug1059606.patch

Don't forget the analogous assertion in CheckCoercedSimdOpCall in the other patch.  (Or you could just remove the assert... the property seems straightforward enough.)
Attachment #8480406 - Flags: review?(luke) → review+
https://hg.mozilla.org/mozilla-central/rev/e3ba68954c27
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
Flags: qe-verify-
You need to log in before you can comment on or make changes to this bug.