924660 - Assertion failure: lhs->type() == MIRType_Int32, at jit/Lowering.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function(stdlib, n, heap) {
    "use asm"
    var Float64ArrayView = new stdlib.Float64Array(heap);
    function f() {
        var d2 = 5.;
        Float64ArrayView[2] = +(~~((d2 - d2) / d2))
    }
})()

asserts js debug shell on m-c changeset e8a363fcd35b with --ion-gvn=off --ion-eager at Assertion failure: lhs->type() == MIRType_Int32, at jit/Lowering.cpp

My configure flags are:
CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Setting needinfo on myself to run autoBisect..

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/a70ad9d7e0f4
user:        Dan Gohman
date:        Thu Oct 03 17:25:03 2013 -0700
summary:     Bug 915846 - IonMonkey: Simple range analysis for div and sqrt. r=nbp

Dan, is bug 915846 a possible regressor?

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 3

[Dan Gohman [:sunfish]]

Yes, bug 915846 is the regressor here. Specifically, patch 6afebbb8e595 -- it looks like I accidentally mixed part of an unrelated patch into that patch. The change to MDiv::truncate does not belong there, and it's what's causing this bug.

Comment 4

[Dan Gohman [:sunfish]]

Attachment: range-revert-mdiv-truncate.patch

This patch reverts MDiv::truncate back to its state before that patch, which fixes the bug.

Comment 5

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/44eee084be1d

Comment 6

[Phil Ringnalda (:philor)]

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/f03466d0e283 for making ion/bug898857.js | --ion-eager and jaeger/recompile/staticoverflow.js | --ion-eager fail on debug and shell tests a la https://tbpl.mozilla.org/php/getParsedLog.php?id=28931249&tree=Mozilla-Inbound

Comment 7

[Dan Gohman [:sunfish]]

Arg. The fix depends on part of the fix for bug 923659.

Comment 8

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/eba7271a9bee

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/eba7271a9bee