940846 - Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: lldb stack

function a(f, i) {
    results = []
    for (var k = 0; i.length; ++k) {
        try {
            results.push(f(i[k]));
        } catch (e) {
            results.push(e);
        }
    }
}
g = (function(x, y) {
    return Math.fround((x ? Math.f : m0) ? w : Math.fround())
})
a(g, [Number.MAX_VALUE])

asserts js debug shell on m-c changeset 4f993fa378eb with --ion-eager at Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --disable-threadsafe

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/58605e9a6ea1
user:        Kannan Vijayan
date:        Tue Nov 12 14:20:34 2013 -0500
summary:     Bug 912303 - Added noSuchMethod support to baseline CALLPROP/CALLELEM stubs. r=efaust

Not sure if bug 912303 is really at fault here. Kannan/Benjamin?

Comment 1

[Jesse Ruderman]

It's actually important that the loop is infinite -- it takes about 50000 iterations to hit the bug, unless I stick in a manual gc call.  How did jsfunfuzz even?

Comment 2

[Jesse Ruderman]

After some more manual reduction I was able to remove the gc call.

var r = []
r.push(Math.fround(0));
for (var i = 0; i < 1; ++i) {
    r.push('x');
}

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Patch + test

MArrayPush shouldn't have a Float32 as an input.

Jesse, the reduced test case doesn't assert with --ion-eager on my machine. The first one asserts after ~37000 iterations, so I changed it to iterate until 40000 instead. However, the entire test lasts around 5 seconds and I am not really satisfied with that.
Did you run your shell test with some other runtime flags or configure flags?

Comment 4

[Sean Stangl [:sstangl]]

Comment on attachment 8335165 [details] [diff] [review]
Patch + test

Review of attachment 8335165 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/ion/bug940846.js
@@ +1,4 @@
> +function a(f, i) {
> +    results = []
> +    for (var k = 0; k < 50; ++k) {
> +    //for (var k = 0; i.length; ++k) {

Does the bug reproduce with k < 50 instead of the iloop?

Comment 5

[Jesse Ruderman]

Gary was also unable to reproduce with my reduced testcase.

The first step in my reduction was to add a gc() call and reduce the number of iterations.  Does this still reproduce for you?

function a(f, i) {
    results = []
    for (var k = 0; k < 10; ++k) {
        gc();
        try {
            results.push(f(i[k]));
        } catch (e) {
            results.push(e);
        }
    }
}
g = (function(x, y) {
    return Math.fround((x ? Math.f : m0) ? w : Math.fround())
})
a(g, [Number.MAX_VALUE])

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

Thanks Jesse for this reduced test case, I like it better and it's way faster to execute.

https://hg.mozilla.org/integration/mozilla-inbound/rev/535370a8c66f

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/535370a8c66f