"Assertion failure: unexpected constantly false guard detected" with typed array

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
9 years ago
7 years ago

People

(Reporter: jruderman, Assigned: njn)

Tracking

(Blocks 1 bug, {assertion, testcase})

Trunk
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 -, status2.0 wanted)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

Reporter

Description

9 years ago
for (let j=0; j<9; ++j) { var a = new Int8Array(); a[0] = 5; a[0]; }

Assertion failure: unexpected constantly false guard detected, 
at jstracer.cpp:4328

The first bad revision is:
changeset:   http://hg.mozilla.org/tracemonkey/rev/0084457d2cfc
user:        Nicholas Nethercote
date:        Mon Oct 18 12:55:56 2010 -0700
summary:     Bug 584279 - TM: improve alias analysis by adding many more access regions (2nd attempt).  r=bhackett.
Assignee

Comment 1

9 years ago
This is simple.  The a[0] SETELEM bounds check always fails, so we always side-exit on it (though Nanojit doesn't detect that it always fails).  However,  Nanojit does determine that the a[0] GETELEM bounds check always fails, so it complains.

This is an unlikely case, so we can just abort.  The attached patch does this.

There's no need for this to block 2.0.  In an optimized build the tracejit will generate correct but sub-optimal code.
Assignee: general → nnethercote
Status: NEW → ASSIGNED
Attachment #501234 - Flags: review?(vladimir)

Updated

9 years ago
blocking2.0: --- → -
status2.0: --- → wanted
Assignee

Comment 2

9 years ago
http://hg.mozilla.org/tracemonkey/rev/881166c2051f
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/881166c2051f
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.