Closed Bug 1071047 Opened 5 years ago Closed 5 years ago

Assertion failure: numPredecessors() >= 2, at jit/MIRGraph.h:409

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla35

People

(Reporter: decoder, Assigned: sunfish)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

The following testcase asserts on mozilla-central revision 5bd6e09f074e (run with --fuzzing-safe --thread-count=2 --ion-eager):


function range(n, m) {
  var result = [];
  for (var i = n; i < m; i++)
    result.push(i);
  return result;
}
function assertParallelExecWillBail(opFunction) {
  opFunction({mode:"compile"});
}
var ints = range(0, 100000);
assertParallelExecWillBail(function (m) {
  ints.mapPar(kernel, m);
});
function kernel(v) {
    if (inParallelSection()) {
      for (var i = 0; mapPar < 50; i++) {
        for (var ints;;) {}
    }
  }
}
Can this be related to the UCE changes? RemoveUnmarkedBlocks is used during ParallelSafetyAnalysis.
Flags: needinfo?(sunfish)
Another RemoveUnmarkedBlocks fix. MBasicBlock::removePredecessor does extra checks if the block is a loop header. RemoveUnmarkedBlocks is doing the sweep of a mark and sweep, so these checks are unneeded and spurious.
Assignee: nobody → sunfish
Attachment #8493825 - Flags: review?(shu)
Flags: needinfo?(sunfish)
Comment on attachment 8493825 [details] [diff] [review]
clear-loop-header.patch

Review of attachment 8493825 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the wait.
Attachment #8493825 - Flags: review?(shu) → review+
https://hg.mozilla.org/mozilla-central/rev/5ac6d1958f31
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.