Closed Bug 900437 Opened 9 years ago Closed 9 years ago

Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp:510

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla26
Tracking Status
firefox24 --- affected
firefox25 --- affected

People

(Reporter: decoder, Assigned: sunfish)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files, 2 obsolete files)

The following testcase asserts on mozilla-central revision 05d3797276d3 (run with --fuzzing-safe --ion-eager --ion-regalloc=backtracking):


function test() {
    var x = 0.0;
    while(1) -("") >> x / x;
}
test();
Blocks: 826741
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:bisect]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Whiteboard: [jsbugmon:bisect] → [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/4370f503d69f
user:        Brian Hackett
date:        Thu May 23 13:25:19 2013 -0600
summary:     Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem.

This iteration took 10.723 seconds to run.
Needinfo from Brian based on comment 3.
Flags: needinfo?(bhackett1024)
I believe this is a bug with how the x86 lowering code creates LDivI. I am working on a patch.
Assignee: general → sunfish
Flags: needinfo?(bhackett1024)
Attached patch div-self.patch (obsolete) — Splinter Review
The comment added in Lowering-x86-shared.cpp briefly explains the tricky situation imposed by LDivI's constraints here.

Other approaches to fixing this bug are possible. One could say that the register allocator should provide mechanisms to allow the constraints to be precisely modeled, however as long as this situation is limited to LDivI, it isn't obviously worthwhile. The attached patch has the advantage of being uncomplicated and unobtrusive.
Attachment #785439 - Flags: review?(bhackett1024)
Attached patch div-self.patchSplinter Review
Updated to include the testcase.
Attachment #785439 - Attachment is obsolete: true
Attachment #785439 - Flags: review?(bhackett1024)
Attachment #785441 - Flags: review?(bhackett1024)
Comment on attachment 785441 [details] [diff] [review]
div-self.patch

Review of attachment 785441 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay, and thanks!

::: js/src/ion/shared/CodeGenerator-x86-shared.cpp
@@ +766,5 @@
> +    Register output = ToRegister(ins->output());
> +    MDiv *mir = ins->mir();
> +
> +    JS_ASSERT(mir->canBeDivideByZero());
> +        

rm extra whitespace
Attachment #785441 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/3ec1dff8c460
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Attachment #784326 - Attachment is obsolete: true
Duplicate of this bug: 884630
You need to log in before you can comment on or make changes to this bug.