1783507 - Assertion failure: IsResumableMIRType(op->type())

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[lukas.bernhard]

Steps to reproduce:

On git commit 8e2e05ea9683 the attached sample triggers an assertion violation: Assertion failure: IsResumableMIRType(op->type()) (Resume point cannot encode its operands), at js/src/jit/IonAnalysis.cpp:3383
Bisecting the issue points to commit 7e937f10b173 related to bug 1062893.

obj-x86_64-pc-linux-gnu/dist/bin/js --fast-warmup --no-threads bug.js

bug.js:

function main() {
    const v4 = new Uint16Array();
    while (0 < 7) {
        let v7 = 0 in v4;
        ({"a":v7} = v4);
    }
    const v9 = [0,0,0,0,0]; 
    for (const v10 of v9) { }
}
main();

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1062893

Comment 2

[André Bargull [:anba]]

Thanks for the test case!

Comment 3

[André Bargull [:anba]]

Attachment: Bug 1783507: Only recover MCompare with recoverable inputs. r=iain!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3e49696955b6
Only recover MCompare with recoverable inputs. r=iain

Comment 6

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/3e49696955b6