Closed Bug 915608 Opened 6 years ago Closed 6 years ago

Assertion failure: ins->block() == block, at jit/ValueNumbering.cpp:406

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla26

People

(Reporter: decoder, Assigned: bbouvier)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,ignore])

Attachments

(2 files)

The following testcase asserts on mozilla-central revision a98569f21abe (run with --fuzzing-safe --ion-eager):


function f1() {
    var b = new Float32Array(50);
    for (var i=0; i < 100; true ? ++i : x.foo()) {
        var x = b[i];
	typeof x;
    }
}
f1();
Probably float32 related :)
Flags: needinfo?(bbouvier)
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/a43cf13bd6a6
user:        Benjamin Bouvier
date:        Thu Jul 18 15:13:15 2013 -0700
summary:     Bug 888109: Float32 general optimizations for IonMonkey: framework and arithmetic operations; r=sstangl,nbp

This iteration took 358.364 seconds to run.
Attached patch fix + test caseSplinter Review
Duh, thanks Christian!
Assignee: general → bbouvier
Status: NEW → ASSIGNED
Attachment #804024 - Flags: review?(efaustbmo)
Flags: needinfo?(bbouvier)
Comment on attachment 804024 [details] [diff] [review]
fix + test case

Whoops. Nice catch.
Attachment #804024 - Flags: review?(efaustbmo) → review+
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision cdfeb4aaea9c).
https://hg.mozilla.org/mozilla-central/rev/c7ccd2f2d4a4
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
You need to log in before you can comment on or make changes to this bug.