865024 - IonMonkey: Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp:508

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision aa620f3fc2f7 (run with --ion-regalloc=backtracking --ion-eager):


var d = new FakeDOMObject();
for (var i=0; i<100; i++) {
    d.x = 10;
}

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jsfunfuzz hit this as well.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

This looks like a bug when lowering SetDOMProperty.  The instruction wants to use the same registers for its input as it does for some of its temps, which the backtracking allocator can't find a way to satisfy.  Judging from the surrounding comments the input registers should be distinct from the temporary ones.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3519bc0b981a

Comment 4

[(Out Sep 17-23) Ryan VanderMeulen]

https://hg.mozilla.org/mozilla-central/rev/3519bc0b981a