1763970 - Assertion failure: graph().osrBlock(), at js/src/jit/WarpBuilder.cpp:298

Status: RESOLVED DUPLICATE of bug 1762769

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[lukas.bernhard]

Steps to reproduce:

On git commit e14928941e53 spidermonkey crashes with:
Assertion failure: graph().osrBlock(), at js/src/jit/WarpBuilder.cpp:298
Bisecting the issue identifies commit e14928941e538ab39c6c0d84e9836e0eb6cbcc9a related to bug 885514.

obj-x86_64-pc-linux-gnu/dist/bin/js --fast-warmup --no-threads --cpu-count=1 --ion-offthread-compile=off --fuzzing-safe

sample.js

function main() {
  try {
  }
  finally {
      let v7 = 0;
      while (v7 < 5) {
          v7++;
      }
      try {
          throw Uint8Array;
      }
      catch(v12) {
      }
  }
  for (let v52 = 0; v52 < 100; v52++) {  }
}
main();

Comment 1

[Nicolas B. Pierron [:nbp]]

Iain can you look at this issue, this sounds like this might potentially be a huge issue and the alternative is to completely disable Ion/Warp.

Comment 2

[Iain Ireland [:iain]]

This is a duplicate of bug 1762769.