928450 - Assertion failure: lower_ <= upper_, at jit/RangeAnalysis.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack without symbols

(function() {
    "use asm"
    function f() {
        i((1.5 != 2.) ? 3 : 0)
    }
})()

asserts js debug shell on m-c changeset 4e7d1e2c93a6 with --ion-gvn=off at Assertion failure: lower_ <= upper_, at jit/RangeAnalysis.h

Tested with:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1382089332/jsshell-mac64.zip

which I presume is a 64-bit debug non-deterministic threadsafe build.

Guessing this is range analysis at play again.

Comment 1

[Dan Gohman [:sunfish]]

Confirmed. Range analysis is computing an invalid range on the path where "1.5 != 2" isn't true. This is a regression in the changes for bug 918607. I'll work on a patch.

This also happens to be an argument for converting range analysis from (int32,bool) bounds to plain double bounds. Double bounds wouldn't need a separate max_exponent_ field, there'd be no need to have code to keep it consistent with lower_/upper_. But that's beyond the scope of this bug :).

Comment 2

[Nicolas B. Pierron [:nbp]]

(In reply to Dan Gohman [:sunfish] from comment #1)
> This also happens to be an argument for converting range analysis from
> (int32,bool) bounds to plain double bounds.

Please, do not mix fix and features, until there is no easy fix.

Comment 3

[Dan Gohman [:sunfish]]

Attachment: range-empty-after-refinement.patch

There is an easy fix. Range::intersect just needs to check for an empty range after making adjustments to lower_ and upper_.

Comment 4

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3f03e8b077ca

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/3f03e8b077ca