Closed Bug 1521092 Opened 2 years ago Closed 2 years ago

ARM64: Assertion failed: got 5, expected 4 at _[0] (basic/array-copyWithin.js)


(Core :: JavaScript Engine: JIT, defect)

Not set



Tracking Status
firefox-esr60 --- wontfix
firefox64 --- wontfix
firefox65 --- wontfix
firefox66 --- fixed


(Reporter: nbp, Assigned: nbp)


(Blocks 1 open bug)


(Keywords: crash, Whiteboard: [arm64:m3])


(2 files)

No description provided.
This patch adds a bunch more context information to CacheIR generated code, by
displaying the name of the function like we already do with the LIR instruction
name in IonMonkey.

I would not have been able to locate the issue without this patch.
Attachment #9038604 - Flags: review?(sstangl)
The issue was that CacheIRCompiler::emitGuardIsInt32Index would, only in the
IonMonkey case, push and pop a Float register on the stack.

The problem was that that MacroAssemblerCompat::pop(FloatRegister) was
implemented using the register code instead of using the ARMFPRegister
constructor which does the conversion from FloatRegister to an ARMFPRegister.

Therefore, we poped the doubled value in the x0 register instead of popping the
value in d0, erasing the previous value and causing either differential
behaviours or crashes.
Attachment #9038607 - Flags: review?(sstangl)
Attachment #9038604 - Flags: review?(sstangl) → review+
Comment on attachment 9038607 [details] [diff] [review]
ARM64: pop(FloatRegister) use ARMFPRegister instead of the register code.

Review of attachment 9038607 [details] [diff] [review]:

Argh. What a footgun.
Attachment #9038607 - Flags: review?(sstangl) → review+

The codegen spew patch needs rebasing.

Flags: needinfo?(nicolas.b.pierron)
Keywords: checkin-needed

[arm64:m3] because we should fix reproducible test crashes before letting ARM64 Fennec Nightly ride the trains to Beta.

Keywords: crash
Whiteboard: [arm64:m3]
Duplicate of this bug: 1522272
Duplicate of this bug: 1522297
Duplicate of this bug: 1522274
Duplicate of this bug: 1522275
Duplicate of this bug: 1522248
Duplicate of this bug: 1522269
Duplicate of this bug: 1522293
Pushed by
Codegen Spew: Output the name of the CacheIR functions. r=sstangl
ARM64: pop(FloatRegister) use ARMFPRegister instead of the register code. r=sstangl
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
Flags: needinfo?(nicolas.b.pierron)
You need to log in before you can comment on or make changes to this bug.