911368 - OdinMonkey: Assertion failure: ins->mirRaw()->isDiv() || ins->mirRaw()->isAsmJSUDiv() || ins->mirRaw()->isAsmJSUMod(), at jit/arm/CodeGenerator-arm.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function (stdlib, heap) {
    "use asm";
    function f(i0) {
        i0 = i0 | 0;
        switch (0xc << (0xa % 1)) {
            case -2:
        };
    }
})()

asserts js debug shell on ARM on m-c changeset 8c5a94ba1096 with --no-baseline --ion-eager --ion-gvn=off at Assertion failure: ins->mirRaw()->isDiv() || ins->mirRaw()->isAsmJSUDiv() || ins->mirRaw()->isAsmJSUMod(), at jit/arm/CodeGenerator-arm.cpp

My configure flags are:

--enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-threadsafe --with-ccache <other NSPR flags>

(If only --ion-eager was used, it seems to show the assertion in bug 879647.)

This may be a regression from whenever OdinMonkey landed, so setting needinfo from Luke.

Comment 1

[Luke Wagner [:luke]]

Benjamin: do you suppose this is the recent switch patch?

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

I don't think so. Seems like LIRGeneratorARM::lowerModI can call lowerUMod, that generates a LSoftUDivOrMod with a MMod as the attached mir value, hence the assertion. Not sure that simply adding "|| ins->mirRaw()->isMod()" would be enough to fix it, though.

Comment 3

[Marty Rosenberg [:mjrosenb]]

IIRC, this was the fix when a similar issue cropped up in the past.

Comment 4

[Luke Wagner [:luke]]

Is this the same sort of issue as bug 898857?

Comment 5

[Jon Coppeard (:jonco)]

Oh, yes, the assert is wrong, I'll fix it.

Comment 6

[Jon Coppeard (:jonco)]

Attachment: bug911368-assertion

As pointed out in comment 2, the assertion is wrong because these LIR nodes can be generated for an MMod too.  This patch fixes the assertion and adds the test case.

Comment 7

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/eca7b6459131

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/eca7b6459131