Closed Bug 755194 Opened 12 years ago Closed 12 years ago

MersenneTwister19937 causes "Assertion failure: slot > 0 && slot <= int32(graph.localSlotCount())" with --ion-regalloc=greedy

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [js:t][fuzzblocker:--ion-regalloc=greedy]) 

Assertion failure: slot > 0 && slot <= int32(graph.localSlotCount()), at js/src/ion/shared/CodeGenerator-shared.h:130

Discovered using:
  https://hg.mozilla.org/projects/ionmonkey/rev/269dba32ca50

Regression caused by:
  https://hg.mozilla.org/projects/ionmonkey/rev/8a2010ae3d08 (bug 735400)


./js --ion-regalloc=greedy --ion-eager

(function() {
  var UPPER_MASK = 0x80000000;

  function unsigned32(n) {
    return n < 0 ? (n ^ UPPER_MASK) + UPPER_MASK : n;
  }

  for (var j = 1; j < 3; ++j) {
    for (var i = 0; i < 32; ++i) {
      unsigned32(1 << i);
    }
  }
})();
We're not going to ship with the greedy allocator (not right away), so for now we can postpone this bug.
Whiteboard: [fuzzblocker] → [fuzzblocker:--ion-regalloc=greedy]
Whiteboard: [fuzzblocker:--ion-regalloc=greedy] → [js:t][fuzzblocker:--ion-regalloc=greedy]
WFM

The first good revision is:
changeset:   c4c50dc6317c
parent:      a29f6c635516
parent:      be26e809e6b1
user:        David Anderson
date:        Fri Jul 13 19:50:02 2012 -0700
summary:     Merge from mozilla-central.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.