1743774 - Assertion failure: type() == MIRType::Int32, at jit/MIR.cpp:3159

Status: RESOLVED DUPLICATE of bug 1743715

(Core :: JavaScript: WebAssembly, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

new WebAssembly.Module(wasmTextToBinary(`
(module
 (global $global$0 (mut i32) (i32.const 1))
 (memory $0 0)
 (func $0
  (global.set $global$0
   (i32.const 1)
  )
  (loop $label$1
   (if
    (global.get $global$0)
    (br_if $label$1
     (i64.eqz
      (i64.xor
       (i64.const -1)
       (if (result i64)
        (i32.const 1)
        (i64.load
         (i32.const 1)
        )
        (i64.const 1)
       )
      )
     )
    )
   )
  )
 )
)
`))

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7d2f50ffa706
user:        Julian Seward
date:        Fri Nov 26 18:41:12 2021 +0000
summary:     Bug 1741392 - Remove redundant xor64 with all-ones input for wasm-via-Ion.  r=lth,nbp.

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ./configure --enable-debug --with-ccache --enable-gczeal --enable-debug-symbols --disable-bootstrap --disable-tests, tested on m-c rev 58d2fbdb6b4a.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Bug 1743715 is a real world equivalent issue of this (without a testcase as per bug 1743715 comment 4).

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: possible fix

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 9253185 [details] [diff] [review]
possible fix

Tested on m-c rev a36723a06c6e.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Possible cause analysis:

The code in MBitNot::foldsTo is specifically only for Int32. Now, bug 1741392 added support for allowing MBitNot to support Int64, so this assertion now fails. The fix should be to return early when it is Int64, similar to the way it is done in MBitNot::computeRange for that patch, and also prior to m-c rev 5b653e25e757, which was the rev that made MBitNot specific to Int32.

i.e. in https://hg.mozilla.org/mozilla-central/rev/5b653e25e757#l4.20 one can see that we return this if the type/specialization is not Int32.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1741392

Comment 7

[Lars T Hansen [:lth]]

Fix landed in the open as part of a previously reported (open) bug.

Comment 8

[Daniel Veditz [:dveditz]]

This problem was initially reported (in bug 1743715) within the 4 day "regression grace" period so unfortunately this bug does not qualify for a bug bounty.