885034 - Assertion failure: builder->script()->canIonCompile(), at ion/Ion.cpp with --enable-threadsafe

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function x(a) {
    for each(let a in []) {}
}
ParallelArray(4277, x);

asserts js debug shell on m-c changeset c12150cfdfef with --ion-parallel-compile=on at Assertion failure: builder->script()->canIonCompile(), at ion/Ion.cpp

--enable-threadsafe seems to be required here.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/48afaae197ab
user:        Gavin Sharp
date:        Fri May 31 14:56:48 2013 -0700
summary:     Bug 878291: define RELEASE_BUILD/NIGHTLY_BUILD in the js configure too, r=ted

(not sure if this is correct)

Comment 1

[:Gavin Sharp [email: [e-mail]]]

Same deal as bug 885017 comment 2

Comment 2

[Niko Matsakis [:nmatsakis]]

I do not observe this problem locally.

Comment 3

[Shu-yu Guo [:shu]]

I can't repro either. Could we get a re-autobisect? Maybe I fixed it?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/e6af6512b05e
user:        Shu-yu Guo
date:        Tue Jun 25 18:28:22 2013 -0700
summary:     Bug 886632 - Rename ParallelArrayAnalysis to ParallelSafetyAnalysis; move it before GVN; remove its dependency on JSContext. (r=nmatsakis)

Yes, was this likely fixed by bug 886632?

Comment 5

[Shu-yu Guo [:shu]]

Looks like it was a drive-by fix by jandem:

https://hg.mozilla.org/mozilla-central/rev/3efe3f3d2c25#l4.38

Closing.