671814 - TI: Assertion failure: fe < temporariesTop, at methodjit/FrameState.h:1034

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 9b9fd467eb5f (run with -j -m -a -n), tested on 64 bit:


var ta = Int8Array([]);
function Int8Array(summary) {
    summary.length;
}
function test() {
    ctors = [ Int8Array ]
    for (var i = 0;;) {
        ctor = ctors[i]
        b = ctor(0)
    }
}
test();

Comment 1

[Jan de Mooij [:jandem]]

Looked at this because I thought it was from my typed array patches, but it's a LICM problem. Asserts on 64-bit, crashes on 32-bit.

In LoopState::invariantLength objSlot is UNASSIGNED (UINT32_MAX) and in a debug build frame.entryName(objSlot) asserts.

Comment 2

[Brian Hackett [Laid off!]]

This problem was in several places where the loop state computes an intermediate loop value in terms of the state at the loop head.  For possible object-valued entries we did not bail out if the value was determined to be a constant integer.  With the cross-script SSA that the loop state uses when combining LICM + call inlining, it can determine something is a constant integer even if type information indicates it may be an object.

http://hg.mozilla.org/projects/jaegermonkey/rev/36813ba5ea40

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/loops/bug671814.js.