Closed Bug 1105187 Opened 5 years ago Closed 5 years ago

Assertion failure: iter->instruction()->block() == *block, at jit/IonAnalysis.cpp

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla37
Tracking Status
firefox36 --- affected

People

(Reporter: gkw, Assigned: nbp)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

(function(x) {
    x = +x
    switch (y) {
        case -1:
            x = 0
    }
})()

asserts js debug shell on m-c changeset acde07cb4e4d with --ion-eager --no-threads --ion-gvn=off at Assertion failure: iter->instruction()->block() == *block, at jit/IonAnalysis.cpp.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9188c8b7962b
user:        Nicolas B. Pierron
date:        Mon Nov 24 16:11:32 2014 +0100
summary:     Bug 1093674 - IonMonkey: Add Sink for instruction which can be recovered on bailout. r=sunfish

Nicolas, is bug 1093674 a likely regressor?
Flags: needinfo?(nicolas.b.pierron)
Attached file stack
(lldb) bt 5
* thread #1: tid = 0x48cbaa, 0x00000001002b625f js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertBasicGraphCoherency(js::jit::MIRGraph&) [inlined] js::InlineForwardListIterator<js::jit::MResumePoint>::operator*() const + 13 at InlineList.h:179, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00000001002b625f js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertBasicGraphCoherency(js::jit::MIRGraph&) [inlined] js::InlineForwardListIterator<js::jit::MResumePoint>::operator*() const + 13 at InlineList.h:179
    frame #1: 0x00000001002b6252 js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertBasicGraphCoherency(graph=<unavailable>) + 3026 at IonAnalysis.cpp:1894
    frame #2: 0x00000001002b744a js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertGraphCoherency(graph=0x00000001020bb040) + 42 at IonAnalysis.cpp:2033
    frame #3: 0x00000001002b82dd js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertExtendedGraphCoherency(graph=0x00000001020bb040) + 45 at IonAnalysis.cpp:2063
    frame #4: 0x00000001002b4f90 js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::OptimizeMIR(mir=0x00000001020bb1a8) + 2752 at Ion.cpp:1571
(lldb)
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #0)
> Nicolas, is bug 1093674 a likely regressor?

I think so, I will look at it later today.
If the instruction is no longer effectful (such as the MMul of 1 after the
apply type phase), then we can discard the resume point.
Attachment #8529275 - Flags: review?(sunfish)
Assignee: nobody → nicolas.b.pierron
Status: NEW → ASSIGNED
Flags: needinfo?(nicolas.b.pierron)
Attachment #8529275 - Flags: review?(sunfish) → review+
https://hg.mozilla.org/mozilla-central/rev/f41f1f33b1b3
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
Blocks: 1109195
You need to log in before you can comment on or make changes to this bug.