The default bug view has changed. See this FAQ.

IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 or Crash [@ js::ion::VirtualRegister::getInterval]

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update,reconfirm,ignore], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision a9a18824b4c1 (run with --ion -n -m --ion-eager):


function Day( t ) {}
function WeekDay( t ) {
  var weekday = (Day(t)+4) % 7;
  return( weekday < 0 ? 7 + weekday : weekday );
}
var expect = 'No Error';
for (var i = 0; i < 2; i++) {
    var [] = expect ? WeekDay( i.a ) : isXMLName.anonymous(i), uneval;
}

Comment 1

5 years ago
The first bad revision is:
changeset:   5108b08c2d54
user:        Sean Stangl
date:        Wed Mar 21 17:25:43 2012 -0700
summary:     Bug 723333 - Handle JSOP_NEW without callVM(). r=dvander
(Reporter)

Updated

5 years ago
Crash Signature: [@ js::ion::VirtualRegister::getInterval]
Summary: IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 → IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 or Crash [@ js::ion::VirtualRegister::getInterval]
(Reporter)

Comment 2

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision de015aff650d).
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,reconfirm]
(Reporter)

Comment 3

5 years ago
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision bc1833f2111e).
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
Created attachment 620481 [details] [diff] [review]
Correctly preserve phis of the |this| slot.

The logic for preserving MPhis of |this| is just wrong -- it arbitrarily preserves the final |this| MPhi, but since it makes that decision too late, the dependencies of that MPhi may have already been removed.

The fix is just to add the |this| MPhi to the observable set.
Attachment #620481 - Flags: review?(dvander)
Attachment #620481 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/525b3eba3bcb
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 6

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug743099.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.