Assertion failure: lower_ <= upper_, at jit/RangeAnalysis.h

RESOLVED FIXED in mozilla27

Status

()

--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: sunfish)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla27
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 819091 [details]
stack without symbols

(function() {
    "use asm"
    function f() {
        i((1.5 != 2.) ? 3 : 0)
    }
})()

asserts js debug shell on m-c changeset 4e7d1e2c93a6 with --ion-gvn=off at Assertion failure: lower_ <= upper_, at jit/RangeAnalysis.h

Tested with:

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1382089332/jsshell-mac64.zip

which I presume is a 64-bit debug non-deterministic threadsafe build.

Guessing this is range analysis at play again.
Flags: needinfo?(sunfish)
(Assignee)

Comment 1

5 years ago
Confirmed. Range analysis is computing an invalid range on the path where "1.5 != 2" isn't true. This is a regression in the changes for bug 918607. I'll work on a patch.

This also happens to be an argument for converting range analysis from (int32,bool) bounds to plain double bounds. Double bounds wouldn't need a separate max_exponent_ field, there'd be no need to have code to keep it consistent with lower_/upper_. But that's beyond the scope of this bug :).
Assignee: general → sunfish
Flags: needinfo?(sunfish)
(Reporter)

Updated

5 years ago
Blocks: 918607
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(In reply to Dan Gohman [:sunfish] from comment #1)
> This also happens to be an argument for converting range analysis from
> (int32,bool) bounds to plain double bounds.

Please, do not mix fix and features, until there is no easy fix.
(Assignee)

Updated

5 years ago
Depends on: 927389
(Assignee)

Comment 3

5 years ago
Created attachment 819379 [details] [diff] [review]
range-empty-after-refinement.patch

There is an easy fix. Range::intersect just needs to check for an empty range after making adjustments to lower_ and upper_.
Attachment #819379 - Flags: review?(nicolas.b.pierron)
Attachment #819379 - Flags: review?(nicolas.b.pierron) → review+
https://hg.mozilla.org/mozilla-central/rev/3f03e8b077ca
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
(Reporter)

Updated

5 years ago
Component: JavaScript Engine → JavaScript Engine: JIT
You need to log in before you can comment on or make changes to this bug.