Closed Bug 913867 Opened 6 years ago Closed 6 years ago

OdinMonkey: Assertion failure: u != 0, at dist/include/mozilla/MathAlgorithms.h

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla26

People

(Reporter: gkw, Assigned: dougc)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files, 1 obsolete file)

Attached file stack
(function(stdlib, n, heap) {
    "use asm"
    var Uint8ArrayView = new stdlib.Uint8Array(heap)
    var Uint32ArrayView = new stdlib.Uint32Array(heap)
    function f(i1) {
        i1 = +i1;
        Uint8ArrayView[0] = Uint32ArrayView[(0 & 0) >> 2]
    }
})()

asserts js debug shell on m-c changeset 655ac375b1c7 without any CLI arguments at Assertion failure: u != 0, at dist/include/mozilla/MathAlgorithms.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin11.4.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Guessing this is OdinMonkey-related.
Flags: needinfo?(luke)
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9f988f6ee6df
user:        Douglas Crosher
date:        Fri Sep 06 07:44:06 2013 +1000
summary:     Bug 865516 - Optimize access to the heap with a constant index. r=luke

Douglas, is bug 865516 likely related?
Blocks: 865516
Flags: needinfo?(luke) → needinfo?(dtc-moz)
Sorry, CountLeadingZeroes32 was being passed an argument of zero
when optimizing heap access using this pattern.
Assignee: general → dtc-moz
Attachment #801186 - Flags: review?(luke)
Flags: needinfo?(dtc-moz)
Comment on attachment 801186 [details] [diff] [review]
Fix CountLeadingZeroes32 being passed an argument of zero.

Review of attachment 801186 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/AsmJS.cpp
@@ +3117,5 @@
>      if (IsLiteralUint32(maskNode, &mask2)) {
>          // Flag the access to skip the bounds check if the mask ensures that an 'out of
>          // bounds' access can not occur based on the current heap length constraint.
> +        if (mask2 == 0 ||
> +            mozilla::CountLeadingZeroes32(f.m().minHeapLength() - 1) <= mozilla::CountLeadingZeroes32(mask2))

Multi-line conditional needs { }.  Instead, I think it'll fit on one line of you put 'using mozilla::CountLeadingZeroes32' at the top of the file and drop the prefix here.
Attachment #801186 - Flags: review?(luke) → review+
The line did not quite fit within 100 characters.

Carrying forward r+.
Attachment #801186 - Attachment is obsolete: true
Attachment #801635 - Flags: review+
Keywords: checkin-needed
Landed with thanks!

https://hg.mozilla.org/integration/mozilla-inbound/rev/4db58a9366f1
Keywords: checkin-needed
Target Milestone: --- → mozilla26
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 680c89c76100).
This landed on m-c:

http://hg.mozilla.org/mozilla-central/rev/4db58a9366f1
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
You need to log in before you can comment on or make changes to this bug.