631788 - Assertion failure: unexpected constantly false guard detected, at jstracer.cpp:4444

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Shell testcase, unpack and run with "js -j -f main.js"

The attached multi-file test case produces the mentioned assertion. Unpack the archive and run with "js -j -f main.js".

When passing through the first assertion in gdb, a second assertion pops up:

Assertion failure: "Constantly false guard detected": 0 (./nanojit/LIR.cpp:1059).

Comment 1

[Nicholas Nethercote [inactive]]

Here's a minimal reproducer:

  for (var j = 1; j < 10; ++j) { switch(0/j) { } }

It doesn't happen on i386 because on i386 the tracer uses tableswitch() for JSOP_TABLESWITCH.  On all other platforms it uses switchop().

More specifically, the division generates this LIR:

00018:   1  div
    ------------------------------ # JSOP_DIV
    gti1 = gti ldi2, strict/*0*/
    jt gti1 -> unpatched
    eqi2 = eqi ldi2, strict/*0*/
    xt1: xt eqi2 -> exit=0x1800598 pc=0x17f966a imacpc=(nil) sp+16 rp+0 OVERFLOW
    immi1 = immi -1
    eqi3 = eqi ldi2, immi1/*-1*/
    immi2 = immi 0x80000000
    immi3 = immi 1
    label2:
    divi1 = divi strict/*0*/, ldi2
    modi1 = modi divi1
    immi4 = immi 0
    eqi4 = eqi modi1, immi4/*0*/
    xf2: xf eqi4 -> exit=0x1800598 pc=0x17f966a imacpc=(nil) sp+16 rp+0 OVERFLOW
**  eqi5 = eqi divi1, immi4/*0*/
**  xt2: xt eqi5 -> exit=0x1800598 pc=0x17f966a imacpc=(nil) sp+16 rp+0 OVERFLOW
    i2d1 = i2d divi1
    sti.sp sp[0] = divi1

The lines marked "**" are key -- if divi1 equals zero, we exit.  NJ now knows that divi1 must be non-zero after that point.  Then when we compile the TABLESWITCH we generate:

    eqi6 = eqi divi1, 0
    xf eqi6

and NJ knows the xf will always exit.

Comment 2

[Nicholas Nethercote [inactive]]

Attachment: patch (againt TM 61584:10df92bfb414)

Looks like our handling of switches is pretty sucky -- if we see any switch value other than the one we saw at record-time, we leave the trace.  Still, I guess it's hard to do much better.

This patch does the obvious thing -- just aborts tracing if it sees the test will always fail.  And it adds a test.

Comment 3

[Nicholas Nethercote [inactive]]

http://hg.mozilla.org/tracemonkey/rev/808734375cf4

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/808734375cf4

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug631788.js.