TM: "Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)"

VERIFIED FIXED

Status

()

Core
JavaScript Engine
P2
critical
VERIFIED FIXED
10 years ago
9 years ago

People

(Reporter: gkw, Assigned: mrbkap)

Tracking

(Blocks: 1 bug, {assertion, testcase, verified1.9.1})

Trunk
x86
Linux
assertion, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
for (var z = 0; z < 2; ++z) { switch(false & 1e-81) {} }

Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)

- TM-only, seems to work as expected.
- Nominating blocking1.9.1 because the verbose output shows something possibly related to js_DoubleToInt32 and switch blocks which was fixed yesterday, but this still occurs TM tip.

===

$ export TRACEMONKEY=verbose
$ ./js-dbg-tm-intelmac -j
js> for (var z = 0; z < 2; ++z) { switch(false & 1e-81) {} }
recording starting from typein:1@11
globalObj=0x9867000, shape=145
    start
    state = param 0 ecx
    0
    sp = ld state[0]
    4
    rp = ld state[4]
    12
    cx = ld state[12]
    8
    gp = ld state[8]
    16
    eos = ld state[16]
    20
    eor = ld state[20]
    40
    globalObj = ld state[40]
    ld1 = ld cx[0]
    eq1 = eq ld1, 0
    xf1: xf eq1 -> 0:11 sp+0 rp+0

00011:   1  false
00012:   1  double 1e-81
00015:   1  bitand
    sti sp[0] = 0
    #2F1E5AAC:F2156838 /* 1e-81 */
    stqi sp[8] = #0x2f1e5aac:#0xf2156838
    js_BooleanOrUndefinedToNumber1 = js_BooleanOrUndefinedToNumber ( cx 0 )

    js_DoubleToInt32_1 = js_DoubleToInt32 ( js_BooleanOrUndefinedToNumber1 )
Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:985)
Trace/breakpoint trap (core dumped)
Flags: blocking1.9.1?
(Assignee)

Comment 1

10 years ago
Created attachment 362297 [details] [diff] [review]
Proposed fix

This is the result of dmandelin and my talking this over for several minutes today. Andreas, could we change the text of this assertion to be something like, "constantly false guard detected?"
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #362297 - Flags: review?(gal)

Updated

10 years ago
Attachment #362297 - Flags: review?(gal) → review+

Comment 2

10 years ago
Comment on attachment 362297 [details] [diff] [review]
Proposed fix

Yeah, sure, the assert text is totally misleading.
(Assignee)

Comment 3

10 years ago
http://hg.mozilla.org/tracemonkey/rev/ac35c12230fa
Whiteboard: fixed-in-tracemonkey

Comment 4

10 years ago
Feel free to improve the assert text!
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2

Comment 6

10 years ago
http://hg.mozilla.org/mozilla-central/rev/ac35c12230fa
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
(Reporter)

Updated

9 years ago
Flags: in-testsuite?

Updated

9 years ago
Keywords: fixed1.9.1

Comment 7

9 years ago
missed recording this...

js1_5/Regress/regress-478314.js	
http://hg.mozilla.org/mozilla-central/rev/915b7595ef9f
Flags: in-testsuite? → in-testsuite+

Comment 8

9 years ago
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.