Closed Bug 911368 Opened 7 years ago Closed 7 years ago

OdinMonkey: Assertion failure: ins->mirRaw()->isDiv() || ins->mirRaw()->isAsmJSUDiv() || ins->mirRaw()->isAsmJSUMod(), at jit/arm/CodeGenerator-arm.cpp

Categories

(Core :: JavaScript Engine, defect)

ARM
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla26

People

(Reporter: gkw, Assigned: jonco)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

Attached file stack
(function (stdlib, heap) {
    "use asm";
    function f(i0) {
        i0 = i0 | 0;
        switch (0xc << (0xa % 1)) {
            case -2:
        };
    }
})()

asserts js debug shell on ARM on m-c changeset 8c5a94ba1096 with --no-baseline --ion-eager --ion-gvn=off at Assertion failure: ins->mirRaw()->isDiv() || ins->mirRaw()->isAsmJSUDiv() || ins->mirRaw()->isAsmJSUMod(), at jit/arm/CodeGenerator-arm.cpp

My configure flags are:

--enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-threadsafe --with-ccache <other NSPR flags>

(If only --ion-eager was used, it seems to show the assertion in bug 879647.)

This may be a regression from whenever OdinMonkey landed, so setting needinfo from Luke.
Flags: needinfo?(luke)
Benjamin: do you suppose this is the recent switch patch?
Flags: needinfo?(luke)
Flags: needinfo?(bbouvier)
I don't think so. Seems like LIRGeneratorARM::lowerModI can call lowerUMod, that generates a LSoftUDivOrMod with a MMod as the attached mir value, hence the assertion. Not sure that simply adding "|| ins->mirRaw()->isMod()" would be enough to fix it, though.
Flags: needinfo?(bbouvier)
IIRC, this was the fix when a similar issue cropped up in the past.
Is this the same sort of issue as bug 898857?
Flags: needinfo?(jcoppeard)
Oh, yes, the assert is wrong, I'll fix it.
Assignee: general → jcoppeard
Status: NEW → ASSIGNED
Flags: needinfo?(jcoppeard)
As pointed out in comment 2, the assertion is wrong because these LIR nodes can be generated for an MMod too.  This patch fixes the assertion and adds the test case.
Attachment #800656 - Flags: review?(mrosenberg)
Attachment #800656 - Flags: review?(mrosenberg) → review+
https://hg.mozilla.org/mozilla-central/rev/eca7b6459131
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
You need to log in before you can comment on or make changes to this bug.