Closed Bug 924660 Opened 8 years ago Closed 8 years ago

Assertion failure: lhs->type() == MIRType_Int32, at jit/Lowering.cpp

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla27

People

(Reporter: gkw, Assigned: sunfish)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:])

Attachments

(2 files)

Attached file stack
(function(stdlib, n, heap) {
    "use asm"
    var Float64ArrayView = new stdlib.Float64Array(heap);
    function f() {
        var d2 = 5.;
        Float64ArrayView[2] = +(~~((d2 - d2) / d2))
    }
})()

asserts js debug shell on m-c changeset e8a363fcd35b with --ion-gvn=off --ion-eager at Assertion failure: lhs->type() == MIRType_Int32, at jit/Lowering.cpp

My configure flags are:
CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Setting needinfo on myself to run autoBisect..
Flags: needinfo?(gary)
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/a70ad9d7e0f4
user:        Dan Gohman
date:        Thu Oct 03 17:25:03 2013 -0700
summary:     Bug 915846 - IonMonkey: Simple range analysis for div and sqrt. r=nbp

Dan, is bug 915846 a possible regressor?
Blocks: 915846
Flags: needinfo?(gary) → needinfo?(sunfish)
Whiteboard: [jsbugmon:update] → [jsbugmon:]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Yes, bug 915846 is the regressor here. Specifically, patch 6afebbb8e595 -- it looks like I accidentally mixed part of an unrelated patch into that patch. The change to MDiv::truncate does not belong there, and it's what's causing this bug.
Assignee: general → sunfish
Flags: needinfo?(sunfish)
This patch reverts MDiv::truncate back to its state before that patch, which fixes the bug.
Attachment #814697 - Flags: review?(nicolas.b.pierron)
Attachment #814697 - Flags: review?(nicolas.b.pierron) → review+
Component: JavaScript Engine → JavaScript Engine: JIT
https://hg.mozilla.org/integration/mozilla-inbound/rev/44eee084be1d
Component: JavaScript Engine: JIT → JavaScript Engine
Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/f03466d0e283 for making ion/bug898857.js | --ion-eager and jaeger/recompile/staticoverflow.js | --ion-eager fail on debug and shell tests a la https://tbpl.mozilla.org/php/getParsedLog.php?id=28931249&tree=Mozilla-Inbound
Arg. The fix depends on part of the fix for bug 923659.
Depends on: 923659
Component: JavaScript Engine → JavaScript Engine: JIT
https://hg.mozilla.org/mozilla-central/rev/eba7271a9bee
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.