IonMonkey: Assertion failure: NYI, at ion/Lowering.cpp:480

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: nbp)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m):


function check(b, desc) {
    function ownProperties(obj) {
        return Object.getOwnPropertyNames(obj).
            map(function (p) { return [p, Object.getOwnPropertyDescriptor(obj, p)]; });
    }
    function notIndex(p) {
        var u = p >>> 0;
    }
    function assertIsCloneOf(a, b, path) {
        var pa = ownProperties(a);
        var aNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex);
        var bNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex);
    }
    var banner = "while testing clone of " + (desc || uneval(b));
    var a = deserialize(serialize(b));
    var queue = [[a, b, banner]];
    var triple = queue.shift();
    assertIsCloneOf(triple[0], triple[1], triple[2]);
}
check({x: 0.7, p: "forty-two", y: null, z: undefined});
check([0, 1, 2, , 4, 5, 6]);
(Assignee)

Comment 1

5 years ago
Test ./jit-test/tests/jaeger/bug593554.js fails identically with --ion --ion-eager -n.
Assignee: general → nicolas.b.pierron
Blocks: 742136
Status: NEW → ASSIGNED
(Assignee)

Comment 2

5 years ago
Created attachment 612772 [details] [diff] [review]
Implement ShiftOp for values operands

Reuse BitOpV LIR, because MShiftOp use the Bitwise policy and as the same signature.
Attachment #612772 - Flags: review?(dvander)
Attachment #612772 - Flags: review?(dvander) → review+
A problem with >>> is that it can return double values if the RHS is 0, see this testcase:

function ursh(x, y) { return x >>> y; };
var o = {valueOf: function() { return -0x80000000; }};

for (var i=0; i<70; i++)
    assertEq(ursh(o, 0), 0x80000000);
(Assignee)

Comment 4

5 years ago
Created attachment 613029 [details] [diff] [review]
Implement ShiftOp for values operands

Use LBinaryV instead of LBitOpV for the Value implementation of Ursh.
- Fix issue in MUrsh::canOverflow (assumed that all constants were int32)
- Fix issue in MIR shift annotations (MLsh, MRsh, MUrsh defined as commutative by MBinaryBitwiseInstruction::infer)
Attachment #612772 - Attachment is obsolete: true
Attachment #613029 - Flags: review?(jdemooij)

Updated

5 years ago
Attachment #613029 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 5

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/49c6f796e3fc
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 6

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug741202.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.