743099 - IonMonkey: Assertion failure: isLowered(), at js/src/ion/MIR.h:429 or Crash [@ js::ion::VirtualRegister::getInterval]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision a9a18824b4c1 (run with --ion -n -m --ion-eager):


function Day( t ) {}
function WeekDay( t ) {
  var weekday = (Day(t)+4) % 7;
  return( weekday < 0 ? 7 + weekday : weekday );
}
var expect = 'No Error';
for (var i = 0; i < 2; i++) {
    var [] = expect ? WeekDay( i.a ) : isXMLName.anonymous(i), uneval;
}

Comment 1

[Jesse Ruderman]

The first bad revision is:
changeset:   5108b08c2d54
user:        Sean Stangl
date:        Wed Mar 21 17:25:43 2012 -0700
summary:     Bug 723333 - Handle JSOP_NEW without callVM(). r=dvander

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision de015aff650d).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision bc1833f2111e).

Comment 4

[Sean Stangl [:sstangl]]

Attachment: Correctly preserve phis of the |this| slot.

The logic for preserving MPhis of |this| is just wrong -- it arbitrarily preserves the final |this| MPhi, but since it makes that decision too late, the dependencies of that MPhi may have already been removed.

The fix is just to add the |this| MPhi to the observable set.

Comment 5

[Sean Stangl [:sstangl]]

https://hg.mozilla.org/projects/ionmonkey/rev/525b3eba3bcb

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug743099.js.