Assertion failure: live->empty(), at jit/LiveRangeAllocator.cpp

RESOLVED DUPLICATE of bug 1071879

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED DUPLICATE of bug 1071879
4 years ago
4 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox35 affected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
setIonCheckGraphCoherency()
function f(x) {
    x(Math.hypot(x && 0, 4294967296))
}
try {
    f(Infinity)
} catch (e) {}
f()

asserts js debug shell on m-c changeset 9e193395b912 with --no-threads --ion-eager at Assertion failure: live->empty(), at jit/LiveRangeAllocator.cpp.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140923002344" and the hash "b3c0b2156cff".
The "bad" changeset has the timestamp "20140923004245" and the hash "6465e8acae5e".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b3c0b2156cff&tochange=6465e8acae5e

Hannes, is bug 1064537 a possible regressor?
Flags: needinfo?(hv1989)
(Reporter)

Comment 1

4 years ago
Created attachment 8494021 [details]
stack
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: needinfo?(hv1989)
Resolution: --- → DUPLICATE
Duplicate of bug: 1071879
You need to log in before you can comment on or make changes to this bug.