915608 - Assertion failure: ins->block() == block, at jit/ValueNumbering.cpp:406

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision a98569f21abe (run with --fuzzing-safe --ion-eager):


function f1() {
    var b = new Float32Array(50);
    for (var i=0; i < 100; true ? ++i : x.foo()) {
        var x = b[i];
	typeof x;
    }
}
f1();

Comment 1

[Jan de Mooij [:jandem]]

Probably float32 related :)

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/a43cf13bd6a6
user:        Benjamin Bouvier
date:        Thu Jul 18 15:13:15 2013 -0700
summary:     Bug 888109: Float32 general optimizations for IonMonkey: framework and arithmetic operations; r=sstangl,nbp

This iteration took 358.364 seconds to run.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: fix + test case

Duh, thanks Christian!

Comment 5

[Eric Faust [:efaust]]

Comment on attachment 804024 [details] [diff] [review]
fix + test case

Whoops. Nice catch.

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c7ccd2f2d4a4

Comment 7

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision cdfeb4aaea9c).

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/c7ccd2f2d4a4