1071799 - Assertion failure: opBlock->dominates(*block) (Instruction is not dominated by its operands), at jit/IonAnalysis.cpp

Status: RESOLVED DUPLICATE of bug 1071879

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x) {
    (x && 4294967296 >> 0)()
}
try {
    f(Number.MAX_VALUE)
} catch (e) {}
f()

asserts js debug shell on m-c changeset 9e193395b912 with --no-threads --ion-eager at Assertion failure: opBlock->dominates(*block) (Instruction is not dominated by its operands), at jit/IonAnalysis.cpp.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140923002344" and the hash "b3c0b2156cff".
The "bad" changeset has the timestamp "20140923004245" and the hash "6465e8acae5e".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b3c0b2156cff&tochange=6465e8acae5e

Hannes, is bug 1064537 a possible regressor?

Comment 1

[Jeff Walden [:Waldo]]

Another testcase (--ion-eager --no-threads):

  var arr = new Float64Array([1, 2, 3, 4, 5, 6, 7, 8, 9, -0]);
  for (var i = 0; i < 10; i++)
  {
    var el = +arr[i];
    print(uneval(el ? +0 : el));
  }

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack