1071879 - Assertion failure: phi->getOperand(i)->block()->dominates(block->getPredecessor(i)) (Phi input is not dominated by its operand), at jit/IonAnalysis.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function g(f, inputs) {
    for (var j = 0; j < 2; j++) {
        try {
            f(inputs[j])
        } catch (e) {}
    }
}
function f(x) {
    returnx > 0 ? x && Number.MIN_VALUE >> 0 : x;
};
g(f, [-Number.E])

asserts js debug shell on m-c changeset 9e193395b912 with --no-threads --ion-eager at Assertion failure: phi->getOperand(i)->block()->dominates(block->getPredecessor(i)) (Phi input is not dominated by its operand), at jit/IonAnalysis.cpp.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140923002344" and the hash "b3c0b2156cff".
The "bad" changeset has the timestamp "20140923004245" and the hash "6465e8acae5e".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b3c0b2156cff&tochange=6465e8acae5e

Hannes, is bug 1064537 a possible regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Comment 2

[Hannes Verschore [:h4writer]]

Attachment: Hoist constant when folding to it

If we change a ? 0 : a to 0, we need to hoist the "MConstant 0" out of the true branch, so it dominates both branches.

Comment 5

[Hannes Verschore [:h4writer]]

This patch also fixes the duplicated bugs (which show a different assert, but is actually the same issue)

Comment 6

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8494117 [details] [diff] [review]
Hoist constant when folding to it

Review of attachment 8494117 [details] [diff] [review]:
-----------------------------------------------------------------

Sounds good.

nit: Add all 3 test cases.

Comment 7

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d77b931c4b69

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d77b931c4b69