Closed Bug 1070955 Opened 7 years ago Closed 7 years ago

Assertion failure: phi->hasUses() (Missed an unused phi), at jit/ValueNumbering.cpp:689

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla35
Tracking Status
firefox35 --- affected

People

(Reporter: decoder, Assigned: sunfish)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

The following testcase asserts on mozilla-central revision 5bd6e09f074e (run with --no-threads --fuzzing-safe):


try {
Array.prototype.every.call(y, (function() {
    "use asm";
    function f() {
      var v0 = 0.1;
      while (0) {
        v0 = v0 + 1.7;
      }
    }
}));
} catch(exc0) {}
Whiteboard: [jsbugmon:update,bisect]
The backtrace points to GVN. Maybe some fallout from GVN adjustments?
Flags: needinfo?(sunfish)
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8f27a48a25d5
user:        Dan Gohman
date:        Wed Sep 17 10:27:25 2014 -0700
summary:     Bug 1029830 - IonMonkey: GVN: Replace UCE with GVN r=nbp

This iteration took 0.555 seconds to run.
This patch factors out the code for searching for a predecessor index out of removePredecessor and into a helper function, and splits out a removePredecessorWithoutPhiOperands function from removePredecessor so that GVN can remove the phis itself.

The "phi->replaceOperand(index, phi)" was a hack to give removePredecessor something to remove, but it caused the bug by appearing to keep the phi live during the recursive DCE of its operand. The fix is to get rid of the hack and let GVN just remove the operand itself, and then use the new function removePredecessorWithoutPhiOperands instead of removePredecessor.
Assignee: nobody → sunfish
Attachment #8493831 - Flags: review?(nicolas.b.pierron)
Flags: needinfo?(sunfish)
Attachment #8493831 - Flags: review?(nicolas.b.pierron) → review+
https://hg.mozilla.org/mozilla-central/rev/61fd79e2b1ff
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.