Closed Bug 621816 Opened 12 years ago Closed 12 years ago

"Assertion failure: unexpected constantly false guard detected" with typed array

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- -
status2.0 --- wanted

People

(Reporter: jruderman, Assigned: n.nethercote)

Details

(Keywords: assertion, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

for (let j=0; j<9; ++j) { var a = new Int8Array(); a[0] = 5; a[0]; }

Assertion failure: unexpected constantly false guard detected, 
at jstracer.cpp:4328

The first bad revision is:
changeset:   http://hg.mozilla.org/tracemonkey/rev/0084457d2cfc
user:        Nicholas Nethercote
date:        Mon Oct 18 12:55:56 2010 -0700
summary:     Bug 584279 - TM: improve alias analysis by adding many more access regions (2nd attempt).  r=bhackett.
This is simple.  The a[0] SETELEM bounds check always fails, so we always side-exit on it (though Nanojit doesn't detect that it always fails).  However,  Nanojit does determine that the a[0] GETELEM bounds check always fails, so it complains.

This is an unlikely case, so we can just abort.  The attached patch does this.

There's no need for this to block 2.0.  In an optimized build the tracejit will generate correct but sub-optimal code.
Assignee: general → nnethercote
Status: NEW → ASSIGNED
Attachment #501234 - Flags: review?(vladimir)
blocking2.0: --- → -
status2.0: --- → wanted
http://hg.mozilla.org/tracemonkey/rev/881166c2051f
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/881166c2051f
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.