1916807 - Assertion failure: isLowered(), at src/js/src/jit/MIR.h:850

Status: RESOLVED DUPLICATE of bug 1916581

(Core :: JavaScript Engine, defect)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

Checkout commit f09e3f9603a08b5b51bf504846091579bc2ff531 and invoke the js shell:

js --fuzzing-safe --fast-warmup <test-case>

Actual results:

Assertion failure: isLowered(), at  src/js/src/jit/MIR.h:850
#0 0x5572544ad863 in js::jit::MDefinition::virtualRegister() const src/js/src/jit/MIR.h:850:5
#1 0x5572544ad863 in js::jit::LIRGeneratorShared::use(js::jit::MDefinition*, js::jit::LUse) src/js/src/jit/shared/Lowering-shared-inl.h:34:34
#2 0x55725449d69f in js::jit::LIRGeneratorShared::useKeepalive(js::jit::MDefinition*) src/js/src/jit/shared/Lowering-shared-inl.h:563:10
#3 0x55725449d69f in js::jit::LIRGeneratorShared::useKeepaliveOrConstant(js::jit::MDefinition*) src/js/src/jit/shared/Lowering-shared-inl.h:570:10
#4 0x55725449d69f in js::jit::LIRGeneratorShared::buildSnapshot(js::jit::MResumePoint*, js::jit::BailoutKind) src/js/src/jit/shared/Lowering-shared.cpp:269:10
#5 0x55725449de02 in js::jit::LIRGeneratorShared::assignSafepoint(js::jit::LInstruction*, js::jit::MInstruction*, js::jit::BailoutKind) src/js/src/jit/shared/Lowering-shared.cpp:300:29
#6 0x557254a41647 in js::jit::LIRGenerator::visitInstruction(js::jit::MInstruction*) src/js/src/jit/Lowering.cpp:7613:3
#7 0x557254a4242f in js::jit::LIRGenerator::visitBlock(js::jit::MBasicBlock*) src/js/src/jit/Lowering.cpp:7683:10
#8 0x557254a42964 in js::jit::LIRGenerator::generate() src/js/src/jit/Lowering.cpp:7757:10
#9 0x5572548dd776 in js::jit::GenerateLIR(js::jit::MIRGenerator*) src/js/src/jit/Ion.cpp:1546:17
#10 0x5572548de107 in js::jit::CompileBackEnd(js::jit::MIRGenerator*, js::jit::WarpSnapshot*) src/js/src/jit/Ion.cpp:1635:19
#11 0x557254916cad in js::jit::IonCompileTask::runTask() src/js/src/jit/IonCompileTask.cpp:52:24
#12 0x557254916cad in js::jit::IonCompileTask::runHelperThreadTask(js::AutoLockHelperThreadState&) src/js/src/jit/IonCompileTask.cpp:30:5
#13 0x557253638ea5 in js::GlobalHelperThreadState::runTaskLocked(JS::HelperThreadTask*, js::AutoLockHelperThreadState&) src/js/src/vm/HelperThreads.cpp:650:11
#14 0x557253638d1f in js::GlobalHelperThreadState::runOneTask(JS::HelperThreadTask*, js::AutoLockHelperThreadState&) src/js/src/vm/HelperThreads.cpp:606:3
#15 0x55725367c972 in js::HelperThread::threadLoop(js::InternalThreadPool*) src/js/src/vm/InternalThreadPool.cpp:324:25
#16 0x55725367c5b7 in js::HelperThread::ThreadMain(js::InternalThreadPool*, js::HelperThread*) src/js/src/vm/InternalThreadPool.cpp:251:11
#17 0x5572536995a3 in void js::detail::ThreadTrampoline<void (&)(js::InternalThreadPool*, js::HelperThread*), js::InternalThreadPool*&, js::HelperThread*>::callMain<0ul, 1ul>(std::integer_sequence<unsigned long, 0ul, 1ul>) src/js/src/threading/Thread.h:228:5
#18 0x5572536995a3 in js::detail::ThreadTrampoline<void (&)(js::InternalThreadPool*, js::HelperThread*), js::InternalThreadPool*&, js::HelperThread*>::Start(void*) src/js/src/threading/Thread.h:217:11
#19 0x7f846339aac2 in start_thread nptl/pthread_create.c:442:8
#20 0x7f846342c84f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Daniel Veditz [:dveditz]]

Is this a dupe of bug 1916581?

Comment 2

[André Bargull [:anba]]

Yes, it's a dup.