1071839 - Assertion failure: live->empty(), at jit/LiveRangeAllocator.cpp

Status: RESOLVED DUPLICATE of bug 1071879

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

setIonCheckGraphCoherency()
function f(x) {
    x(Math.hypot(x && 0, 4294967296))
}
try {
    f(Infinity)
} catch (e) {}
f()

asserts js debug shell on m-c changeset 9e193395b912 with --no-threads --ion-eager at Assertion failure: live->empty(), at jit/LiveRangeAllocator.cpp.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140923002344" and the hash "b3c0b2156cff".
The "bad" changeset has the timestamp "20140923004245" and the hash "6465e8acae5e".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b3c0b2156cff&tochange=6465e8acae5e

Hannes, is bug 1064537 a possible regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack