If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Assertion failure: iter->instruction()->block() == *block, at jit/IonAnalysis.cpp

RESOLVED FIXED in mozilla37

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: gkw, Assigned: nbp)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Trunk
mozilla37
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox36 affected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

3 years ago
(function(x) {
    x = +x
    switch (y) {
        case -1:
            x = 0
    }
})()

asserts js debug shell on m-c changeset acde07cb4e4d with --ion-eager --no-threads --ion-gvn=off at Assertion failure: iter->instruction()->block() == *block, at jit/IonAnalysis.cpp.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9188c8b7962b
user:        Nicolas B. Pierron
date:        Mon Nov 24 16:11:32 2014 +0100
summary:     Bug 1093674 - IonMonkey: Add Sink for instruction which can be recovered on bailout. r=sunfish

Nicolas, is bug 1093674 a likely regressor?
Flags: needinfo?(nicolas.b.pierron)
(Reporter)

Comment 1

3 years ago
Created attachment 8528908 [details]
stack

(lldb) bt 5
* thread #1: tid = 0x48cbaa, 0x00000001002b625f js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertBasicGraphCoherency(js::jit::MIRGraph&) [inlined] js::InlineForwardListIterator<js::jit::MResumePoint>::operator*() const + 13 at InlineList.h:179, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00000001002b625f js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertBasicGraphCoherency(js::jit::MIRGraph&) [inlined] js::InlineForwardListIterator<js::jit::MResumePoint>::operator*() const + 13 at InlineList.h:179
    frame #1: 0x00000001002b6252 js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertBasicGraphCoherency(graph=<unavailable>) + 3026 at IonAnalysis.cpp:1894
    frame #2: 0x00000001002b744a js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertGraphCoherency(graph=0x00000001020bb040) + 42 at IonAnalysis.cpp:2033
    frame #3: 0x00000001002b82dd js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::AssertExtendedGraphCoherency(graph=0x00000001020bb040) + 45 at IonAnalysis.cpp:2063
    frame #4: 0x00000001002b4f90 js-dbg-opt-64-dm-nsprBuild-darwin-acde07cb4e4d`js::jit::OptimizeMIR(mir=0x00000001020bb1a8) + 2752 at Ion.cpp:1571
(lldb)
(Assignee)

Comment 2

3 years ago
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #0)
> Nicolas, is bug 1093674 a likely regressor?

I think so, I will look at it later today.
(Assignee)

Comment 3

3 years ago
Created attachment 8529275 [details] [diff] [review]
Do not sink effectful instructions.

If the instruction is no longer effectful (such as the MMul of 1 after the
apply type phase), then we can discard the resume point.
Attachment #8529275 - Flags: review?(sunfish)
(Assignee)

Updated

3 years ago
Assignee: nobody → nicolas.b.pierron
Status: NEW → ASSIGNED
Flags: needinfo?(nicolas.b.pierron)
(Reporter)

Updated

3 years ago
status-firefox36: --- → affected

Updated

3 years ago
Attachment #8529275 - Flags: review?(sunfish) → review+
(Assignee)

Comment 4

3 years ago
(try) https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=dcf94a9e3918
(inbound) https://hg.mozilla.org/integration/mozilla-inbound/rev/f41f1f33b1b3
https://hg.mozilla.org/mozilla-central/rev/f41f1f33b1b3
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
(Assignee)

Updated

3 years ago
Blocks: 1109195
You need to log in before you can comment on or make changes to this bug.