ARM: Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp with "use asm"

RESOLVED FIXED in mozilla28

Status

()

--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: sunfish)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla28
ARM
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 759497 [details]
stack

(function () {
    "use asm";
    function f(d0, d1) {
        d0 = +d0;
        d1 = +d1
    }
    return f
})()

asserts js debug shell on m-c changeset 7e3a4ebcf067 with --ion-eager --ion-regalloc=backtracking at Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp

Setting needinfo from Brian as this involves --ion-regalloc=backtracking.
Flags: needinfo?(bhackett1024)
(Reporter)

Updated

5 years ago
Summary: Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp with "use asm" → ARM: Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp with "use asm"
(Reporter)

Comment 1

5 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8f3f965dc116
user:        Douglas Crosher
date:        Mon Mar 25 18:22:45 2013 +1100
summary:     Bug 840285 - ARM support for Ion asm.js (r=luke,mjrosenb also landing some of doug crosher's patches)

(not sure if this is correct)
Blocks: 840285
Flags: needinfo?(dtc-moz)
This patch was the first time that asm.js was enabled for the ARM, and helps confirm that the issue is related to the asm.js specific code paths.  Something to look into, thanks.
Flags: needinfo?(dtc-moz)
(Reporter)

Updated

5 years ago
Blocks: 826741
(Assignee)

Comment 3

5 years ago
The arm backend has d1 as the second floating-point argument register, however d1 is the scratch register and is not marked allocatable. LinearScan seems to cope with this somehow, but Backtracking is not happy about it.

One approach might be to teach the Backtracking allocator to copy the argument into a different register immediately, but that seems unfortunate. How feasible would it be to make the ARM backend use a different register for its floating-point scratch register? One of d8 through d14, so that it isn't an argument register or the NaN register?
Flags: needinfo?(mrosenberg)
(Assignee)

Updated

5 years ago
Depends on: 937944
(Assignee)

Comment 4

5 years ago
I can now confirm that the patch in bug 937944 is sufficient to fix this testcase.
Flags: needinfo?(mrosenberg)
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 5

5 years ago
With bug 937944 fixed, this is now fixed.
Assignee: general → sunfish
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in before you can comment on or make changes to this bug.