Closed
Bug 1059606
Opened 10 years ago
Closed 10 years ago
OdinMonkey: Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla34
Tracking | Status | |
---|---|---|
firefox34 | --- | affected |
People
(Reporter: gkw, Assigned: bbouvier)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker][jsbugmon:update])
Attachments
(1 file)
3.33 KB,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
(function(stdlib) { "use asm" var abs = stdlib.Math.abs function f() { return (abs(0) | 0) } })() asserts js debug shell on m-c changeset 7bd309e55a3d with --no-baseline --no-ion --no-threads at Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp Debug configure flags: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests === Tinderbox Build Bisection Results by autoBisect === The "good" changeset has the timestamp "20140827030629" and the hash "e2eda589ea8d". The "bad" changeset has the timestamp "20140827032329" and the hash "d3f44966d998". Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e2eda589ea8d&tochange=d3f44966d998 Benjamin, not sure which bug in that window is related, but setting needinfo? and I'm getting a smaller regression window soon. This has blown up the fuzzers.
Flags: needinfo?(benj)
Reporter | ||
Comment 1•10 years ago
|
||
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/684b02de6a31 user: Benjamin Bouvier date: Wed Aug 27 12:20:14 2014 +0200 summary: Bug 1052325: AsmJS: make return coercion optional for standard math lib functions calls; r=luke
Blocks: 1052325
Summary: Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp → OdinMonkey: Assertion failure: !!*def, at asmjs/AsmJSValidate.cpp
Assignee | ||
Comment 2•10 years ago
|
||
Thanks for the test case! The assertion is bogus if we're in dead code (which is not obvious in the original test case: the \n after the empty line triggers ASI and thus the next line gets in dead code)
Assignee: nobody → benj
Status: NEW → ASSIGNED
Attachment #8480406 -
Flags: review?(luke)
Flags: needinfo?(benj)
Comment 3•10 years ago
|
||
Comment on attachment 8480406 [details] [diff] [review] bug1059606.patch Don't forget the analogous assertion in CheckCoercedSimdOpCall in the other patch. (Or you could just remove the assert... the property seems straightforward enough.)
Attachment #8480406 -
Flags: review?(luke) → review+
Assignee | ||
Comment 4•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/e3ba68954c27
Comment 5•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/e3ba68954c27
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
Updated•10 years ago
|
Flags: qe-verify-
You need to log in
before you can comment on or make changes to this bug.
Description
•