668206 - IonMonkey: "Assertion failure: JSOp(*bodyStart) == JSOP_TRACE,"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f() {
    for (var i = 0; i < 2; ++i) {}
}
for (let a = 0; a < 40; a++) {
    f((new Array) ^ 0)
}

asserts js debug shell on IM changeset 0d2a1a6e967f with -m and -j at Assertion failure: JSOp(*bodyStart) == JSOP_TRACE,


Due to skipped revisions, the first bad revision could be any of:
changeset:   68998:0e0dc0d8eb72
user:        David Anderson
date:        Thu May 12 14:04:28 2011 -0700
summary:     Refactoring, split into MIRGraph, C1Spewer.

changeset:   68999:80542f060f75
user:        David Anderson
date:        Thu May 12 15:22:49 2011 -0700
summary:     Add some instructions to the c1spew.

changeset:   69000:8d494b4f7be3
user:        David Anderson
date:        Thu May 12 17:27:34 2011 -0700
summary:     While-parsing for MIR generator.

changeset:   69001:ed1149d7f2d3
user:        David Anderson
date:        Thu May 12 18:37:39 2011 -0700
summary:     Correctly assign instruction IDs.

changeset:   69002:26332cb7015e
user:        David Anderson
date:        Fri May 13 15:42:14 2011 -0700
summary:     Fixed snoopControlFlow() not handling nested structures properly.

changeset:   69003:0b447aa65bec
user:        David Anderson
date:        Fri May 13 16:57:16 2011 -0700
summary:     Detect unlabelled continues in the MIR builder.

changeset:   69004:ef75db21dacc
user:        David Anderson
date:        Mon May 16 19:36:05 2011 -0700
summary:     Simple breaks, continues now work - rejiggered how phis are placed, improved spew.

changeset:   69005:ada4e0427297
user:        David Anderson
date:        Tue May 17 17:28:47 2011 -0700
summary:     MIR support for labelled breaks and continues.

changeset:   69006:e156b3dff7c6
user:        David Anderson
date:        Wed May 18 15:29:34 2011 -0700
summary:     Added for loops, rejiggered how phis are placed again.

changeset:   69007:e39539c471e4
user:        David Anderson
date:        Wed May 18 15:57:34 2011 -0700
summary:     Renamed BytecodeAnalyzer to IonBuilder.

changeset:   69008:4c2438684d08
user:        David Anderson
date:        Wed May 18 16:19:48 2011 -0700
summary:     Fix breaks in do-while loops.

changeset:   69009:9e8dcc1310f0
user:        David Anderson
date:        Wed May 18 16:51:12 2011 -0700
summary:     Added missing spew file.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I was not able to compile an IM opt shell to see if this causes any side effects in opt, due to this compile error:

C1Spewer.cpp
JSONSpewer.cpp
IonSpewer.cpp
Lowering-x86.cpp
/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/ion/IonSpewer.cpp: In function ‘void js::ion::IonSpewVA(js::ion::IonSpewChannel, const char*, char*)’:
/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/ion/IonSpewer.cpp:121: error: redefinition of ‘void js::ion::IonSpewVA(js::ion::IonSpewChannel, const char*, char*)’
/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/ion/IonSpewer.h:76: error: ‘void js::ion::IonSpewVA(js::ion::IonSpewChannel, const char*, char*)’ previously defined here
/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/ion/IonSpewer.cpp: In function ‘void js::ion::IonSpew(js::ion::IonSpewChannel, const char*, ...)’:
/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/ion/IonSpewer.cpp:134: error: redefinition of ‘void js::ion::IonSpew(js::ion::IonSpewChannel, const char*, ...)’
/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/ion/IonSpewer.h:74: error: ‘void js::ion::IonSpew(js::ion::IonSpewChannel, const char*, ...)’ previously defined here

In the directory  /Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/opt-objdir
The following command failed to execute properly:
g++-4.2 -arch i386 -o IonSpewer.o -c -fvisibility=hidden -DOSTYPE="Darwin10.8.0" -DOSARCH=Darwin -DEXPORT_JS_API -DIMPL_MFBT -D__STDC_LIMIT_MACROS -I/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src -I. -I./dist/include -I./dist/include/nsprpub -I/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src -I/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/assembler -I/Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/yarr -fPIC -fno-rtti -fno-exceptions -Wall -Wpointer-arith -Woverloaded-virtual -Wsynth -Wno-ctor-dtor-privacy -Wno-non-virtual-dtor -Wcast-align -Wno-invalid-offsetof -Wno-variadic-macros -Werror=return-type -fno-strict-aliasing -fpascal-strings -fno-common -pthread -DNDEBUG -DTRIMMED -g -O3 -fstrict-aliasing -fno-stack-protector -fno-omit-frame-pointer -DUSE_SYSTEM_MALLOC=1 -DENABLE_ASSEMBLER=1 -DENABLE_JIT=1 -DMOZILLA_CLIENT -include ./js-confdefs.h -MD -MF .deps/IonSpewer.pp /Users/skywalker/Desktop/jsfunfuzz-opt-32-im-71690-0d2a1a6e967f/compilePath/js/src/ion/IonSpewer.cpp

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: error dialog on windows

The testcase in comment 0 causes the following error dialog in Windows 7 and somehow does not show the assert message, which makes reducing testcases a pain. :(

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on IM changeset f8aa2ea865c3 on 32-bit js shell in Win 7.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

-j is now gone. Using -m -a --ion -n with changeset 43b55878da46, WFM on Mac Lion with debug 32-bit shell.

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929