ARM64: Assertion failed: got 5, expected 4 at _[0] (basic/array-copyWithin.js)

RESOLVED FIXED in Firefox 66

Status

()

defect
RESOLVED FIXED
6 months ago
26 days ago

People

(Reporter: nbp, Assigned: nbp)

Tracking

(Blocks 1 bug, {crash})

unspecified
mozilla66
ARM64
Unspecified
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr60 wontfix, firefox64 wontfix, firefox65 wontfix, firefox66 fixed)

Details

(Whiteboard: [arm64:m3])

Attachments

(2 attachments)

No description provided.
This patch adds a bunch more context information to CacheIR generated code, by
displaying the name of the function like we already do with the LIR instruction
name in IonMonkey.

I would not have been able to locate the issue without this patch.
Attachment #9038604 - Flags: review?(sstangl)
The issue was that CacheIRCompiler::emitGuardIsInt32Index would, only in the
IonMonkey case, push and pop a Float register on the stack.

The problem was that that MacroAssemblerCompat::pop(FloatRegister) was
implemented using the register code instead of using the ARMFPRegister
constructor which does the conversion from FloatRegister to an ARMFPRegister.

Therefore, we poped the doubled value in the x0 register instead of popping the
value in d0, erasing the previous value and causing either differential
behaviours or crashes.
Attachment #9038607 - Flags: review?(sstangl)
Attachment #9038604 - Flags: review?(sstangl) → review+
Comment on attachment 9038607 [details] [diff] [review]
ARM64: pop(FloatRegister) use ARMFPRegister instead of the register code.

Review of attachment 9038607 [details] [diff] [review]:
-----------------------------------------------------------------

Argh. What a footgun.
Attachment #9038607 - Flags: review?(sstangl) → review+

The codegen spew patch needs rebasing.

Flags: needinfo?(nicolas.b.pierron)
Keywords: checkin-needed

[arm64:m3] because we should fix reproducible test crashes before letting ARM64 Fennec Nightly ride the trains to Beta.

Keywords: crash
Whiteboard: [arm64:m3]
Duplicate of this bug: 1522272
Duplicate of this bug: 1522297
Duplicate of this bug: 1522274
Duplicate of this bug: 1522275
Duplicate of this bug: 1522248
Duplicate of this bug: 1522269
Duplicate of this bug: 1522293
Pushed by npierron@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/35d94075e745
Codegen Spew: Output the name of the CacheIR functions. r=sstangl
https://hg.mozilla.org/integration/mozilla-inbound/rev/9c28047982f2
ARM64: pop(FloatRegister) use ARMFPRegister instead of the register code. r=sstangl
Status: ASSIGNED → RESOLVED
Closed: 6 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
Flags: needinfo?(nicolas.b.pierron)
You need to log in before you can comment on or make changes to this bug.