621816 - "Assertion failure: unexpected constantly false guard detected" with typed array

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

for (let j=0; j<9; ++j) { var a = new Int8Array(); a[0] = 5; a[0]; }

Assertion failure: unexpected constantly false guard detected, 
at jstracer.cpp:4328

The first bad revision is:
changeset:   http://hg.mozilla.org/tracemonkey/rev/0084457d2cfc
user:        Nicholas Nethercote
date:        Mon Oct 18 12:55:56 2010 -0700
summary:     Bug 584279 - TM: improve alias analysis by adding many more access regions (2nd attempt).  r=bhackett.

Comment 1

[Nicholas Nethercote [inactive]]

Attachment: patch (against 58617:7d02185c8366)

This is simple.  The a[0] SETELEM bounds check always fails, so we always side-exit on it (though Nanojit doesn't detect that it always fails).  However,  Nanojit does determine that the a[0] GETELEM bounds check always fails, so it complains.

This is an unlikely case, so we can just abort.  The attached patch does this.

There's no need for this to block 2.0.  In an optimized build the tracejit will generate correct but sub-optimal code.

Comment 2

[Nicholas Nethercote [inactive]]

http://hg.mozilla.org/tracemonkey/rev/881166c2051f

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/881166c2051f

Comment 4

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929