455408 - TM: Assertion failed: "Should not move data from GPR to XMM" with __proto__

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

$ ~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j 
js> for (var j = 0; j < 5; ++j) { if (({}).__proto__ = 1) { } }

Assertion failed: "Should not move data from GPR to XMM": false (nanojit/Nativei386.cpp:1192)

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Not sure why this was crashing in nanojit last night, but it works as expected now. /me whistles in the dark...

/be

Comment 2

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/66a76c8c7346

Comment 3

[Andreas Gal :gal]

Backed out, breaks access-nbody. Tracker gets modified pre-snapshot in miss/hit.

http://hg.mozilla.org/tracemonkey/rev/a775aa0a8e76

Comment 4

[Brendan Eich [:brendan]]

Attachment: better fix

The FullTest hit case was not traced, and also allowed for PCVAL_IS_SLOT even though js_FillPropertyCache will never fill that kind of cache entry value for a JOF_SET opcode -- it will only ever fill such that PCVAL_IS_SPROP.

The main fix is to abort in the uncacheable property set case.

/be

Comment 5

[Brendan Eich [:brendan]]

Attachment: best fix

Previous patch could fail to call any record_JSOP_SETPROP helper yet not abort. Also could call record_SetPropHit twice for cases that do not hit the first-level (pc/shape-indexed) property cache.

Andreas, you mentioned insignificant perf hit -- could you re-test this and say more if it seems to regress perf at all? Thanks,

/be

Comment 6

[Andreas Gal :gal]

Comment on attachment 338864 [details] [diff] [review]
best fix

+ based on testing. SETPROP is above my pay grade. No perf hit.

Comment 7

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/6db3e2a6435b

Comment 8

[Andreas Gal :gal]

Test case: http://hg.mozilla.org/tracemonkey/rev/4b7055be0063

Comment 9

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-455408.js,v  <--  regress-455408.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/8cdae57fff2a