755194 - MersenneTwister19937 causes "Assertion failure: slot > 0 && slot <= int32(graph.localSlotCount())" with --ion-regalloc=greedy

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Assertion failure: slot > 0 && slot <= int32(graph.localSlotCount()), at js/src/ion/shared/CodeGenerator-shared.h:130

Discovered using:
  https://hg.mozilla.org/projects/ionmonkey/rev/269dba32ca50

Regression caused by:
  https://hg.mozilla.org/projects/ionmonkey/rev/8a2010ae3d08 (bug 735400)


./js --ion-regalloc=greedy --ion-eager

(function() {
  var UPPER_MASK = 0x80000000;

  function unsigned32(n) {
    return n < 0 ? (n ^ UPPER_MASK) + UPPER_MASK : n;
  }

  for (var j = 1; j < 3; ++j) {
    for (var i = 0; i < 32; ++i) {
      unsigned32(1 << i);
    }
  }
})();

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

We're not going to ship with the greedy allocator (not right away), so for now we can postpone this bug.

Comment 2

[Jesse Ruderman]

WFM

The first good revision is:
changeset:   c4c50dc6317c
parent:      a29f6c635516
parent:      be26e809e6b1
user:        David Anderson
date:        Fri Jul 13 19:50:02 2012 -0700
summary:     Merge from mozilla-central.