890414 - Assertion failure: safepoint->hasSlotsOrElementsPointer(alloc), at ion/RegisterAllocator.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() {
	for (x = 1; x < 9; x++) {}
}
new f


asserts js debug shell on m-c changeset bc99f68f8946 with --ion-eager --ion-regalloc=backtracking at Assertion failure: safepoint->hasSlotsOrElementsPointer(alloc), at ion/RegisterAllocator.cpp

This blocks fuzzing with --ion-regalloc=backtracking, as it is blowing up jsfunfuzz.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9a62d56be0bc
user:        Jan de Mooij
date:        Wed Jul 03 20:27:39 2013 +0200
summary:     Bug 888872 - Keep track of slots/elements pointers stored in Ion frames for generational GC. r=dvander,terrence

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Tested on m-c tip rev 17fe59f6c54a.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

Ah, the backtracking allocator no longer uses the regalloc verifier to fill safepoints so bug 888872 broke it.

Comment 4

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8e1f9400edde

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8e1f9400edde

Should this have a test?