478314 - TM: "Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (var z = 0; z < 2; ++z) { switch(false & 1e-81) {} }

Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)

- TM-only, seems to work as expected.
- Nominating blocking1.9.1 because the verbose output shows something possibly related to js_DoubleToInt32 and switch blocks which was fixed yesterday, but this still occurs TM tip.

===

$ export TRACEMONKEY=verbose
$ ./js-dbg-tm-intelmac -j
js> for (var z = 0; z < 2; ++z) { switch(false & 1e-81) {} }
recording starting from typein:1@11
globalObj=0x9867000, shape=145
    start
    state = param 0 ecx
    0
    sp = ld state[0]
    4
    rp = ld state[4]
    12
    cx = ld state[12]
    8
    gp = ld state[8]
    16
    eos = ld state[16]
    20
    eor = ld state[20]
    40
    globalObj = ld state[40]
    ld1 = ld cx[0]
    eq1 = eq ld1, 0
    xf1: xf eq1 -> 0:11 sp+0 rp+0

00011:   1  false
00012:   1  double 1e-81
00015:   1  bitand
    sti sp[0] = 0
    #2F1E5AAC:F2156838 /* 1e-81 */
    stqi sp[8] = #0x2f1e5aac:#0xf2156838
    js_BooleanOrUndefinedToNumber1 = js_BooleanOrUndefinedToNumber ( cx 0 )

    js_DoubleToInt32_1 = js_DoubleToInt32 ( js_BooleanOrUndefinedToNumber1 )
Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)
Trace/breakpoint trap (core dumped)

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

This is the result of dmandelin and my talking this over for several minutes today. Andreas, could we change the text of this assertion to be something like, "constantly false guard detected?"

Comment 2

[Andreas Gal :gal]

Comment on attachment 362297 [details] [diff] [review]
Proposed fix

Yeah, sure, the assert text is totally misleading.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/ac35c12230fa

Comment 4

[Jesse Ruderman]

Feel free to improve the assert text!

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Done: http://hg.mozilla.org/tracemonkey/rev/11d992eeca40

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/ac35c12230fa

Comment 7

[Bob Clary [:bc] (inactive)]

missed recording this...

js1_5/Regress/regress-478314.js	
http://hg.mozilla.org/mozilla-central/rev/915b7595ef9f

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2