900437 - Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp:510

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 05d3797276d3 (run with --fuzzing-safe --ion-eager --ion-regalloc=backtracking):


function test() {
    var x = 0.0;
    while(1) -("") >> x / x;
}
test();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/4370f503d69f
user:        Brian Hackett
date:        Thu May 23 13:25:19 2013 -0600
summary:     Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem.

This iteration took 10.723 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Needinfo from Brian based on comment 3.

Comment 5

[Dan Gohman [:sunfish]]

I believe this is a bug with how the x86 lowering code creates LDivI. I am working on a patch.

Comment 6

[Dan Gohman [:sunfish]]

Attachment: div-self.patch

The comment added in Lowering-x86-shared.cpp briefly explains the tricky situation imposed by LDivI's constraints here.

Other approaches to fixing this bug are possible. One could say that the register allocator should provide mechanisms to allow the constraints to be precisely modeled, however as long as this situation is limited to LDivI, it isn't obviously worthwhile. The attached patch has the advantage of being uncomplicated and unobtrusive.

Comment 7

[Dan Gohman [:sunfish]]

Attachment: div-self.patch

Updated to include the testcase.

Comment 8

[Brian Hackett [Laid off!]]

Comment on attachment 785441 [details] [diff] [review]
div-self.patch

Review of attachment 785441 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay, and thanks!

::: js/src/ion/shared/CodeGenerator-x86-shared.cpp
@@ +766,5 @@
> +    Register output = ToRegister(ins->output());
> +    MDiv *mir = ins->mir();
> +
> +    JS_ASSERT(mir->canBeDivideByZero());
> +        

rm extra whitespace

Comment 9

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3ec1dff8c460

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3ec1dff8c460

Comment 11

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature