Last Comment Bug 743099 - IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 or Crash [@ js::ion::VirtualRegister::getInterval]
: IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 or Crash [...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
-- major (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-04-05 17:33 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 07:49 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Correctly preserve phis of the |this| slot. (1.55 KB, patch)
2012-05-02 15:05 PDT, Sean Stangl [:sstangl]
dvander: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-04-05 17:33:14 PDT
The following testcase asserts on ionmonkey revision a9a18824b4c1 (run with --ion -n -m --ion-eager):

function Day( t ) {}
function WeekDay( t ) {
  var weekday = (Day(t)+4) % 7;
  return( weekday < 0 ? 7 + weekday : weekday );
var expect = 'No Error';
for (var i = 0; i < 2; i++) {
    var [] = expect ? WeekDay( i.a ) : isXMLName.anonymous(i), uneval;
Comment 1 User image Jesse Ruderman 2012-04-05 18:09:48 PDT
The first bad revision is:
changeset:   5108b08c2d54
user:        Sean Stangl
date:        Wed Mar 21 17:25:43 2012 -0700
summary:     Bug 723333 - Handle JSOP_NEW without callVM(). r=dvander
Comment 2 User image Christian Holler (:decoder) 2012-04-19 15:28:04 PDT
JSBugMon: The testcase found in this bug no longer reproduces (tried revision de015aff650d).
Comment 3 User image Christian Holler (:decoder) 2012-04-23 08:40:37 PDT
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision bc1833f2111e).
Comment 4 User image Sean Stangl [:sstangl] 2012-05-02 15:05:45 PDT
Created attachment 620481 [details] [diff] [review]
Correctly preserve phis of the |this| slot.

The logic for preserving MPhis of |this| is just wrong -- it arbitrarily preserves the final |this| MPhi, but since it makes that decision too late, the dependencies of that MPhi may have already been removed.

The fix is just to add the |this| MPhi to the observable set.
Comment 5 User image Sean Stangl [:sstangl] 2012-05-02 17:19:50 PDT
Comment 6 User image Christian Holler (:decoder) 2013-01-14 07:49:08 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug743099.js.

Note You need to log in before you can comment on or make changes to this bug.