Closed Bug 944963 Opened 6 years ago Closed 6 years ago

Assertion failure: !minimalInterval(interval), at jit/BacktrackingAllocator.cpp

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: gkw, Assigned: sunfish)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [qa-])

Attachments

(2 files)

Attached file stack
function f(x, y) {
    (+(xy))(y % y)
}
for (var i = 0; i < 9999; i++) {
    try {
        (function() {
            f(0, (~Math.fround(-8)))
        })()
    } catch (e) {}
}

asserts js debug shell on m-c changeset a5e7f611546f with  at Assertion failure: !minimalInterval(interval), at jit/BacktrackingAllocator.cpp

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/e14cd09c843e
user:        Dan Gohman
date:        Tue Nov 26 14:40:55 2013 -0800
summary:     Bug 942236 - IonMonkey: Unsigned optimizations for MMod, MDiv, and MUrsh. r=nbp

Dan, is bug 942236 a likely regressor?
Flags: needinfo?(sunfish)
Attached patch mod-self.patchSplinter Review
Mod has the same problem as Div on x86. This patch introduces a new LModSelf operator, similar to the LDivSelf operator, for doing a modulo of a value by itself, in order to avoid the tricky register allocation constraints.

This replaces the trick of doing an extra copy at the beginning of visitModI, and promotes more consistency between Mod and Div, and between signed and unsigned.

It also adds some tests, and consolidates some existing test cases for similar bugs into a single file.
Assignee: general → sunfish
Attachment #8341112 - Flags: review?(bhackett1024)
Flags: needinfo?(sunfish)
Comment on attachment 8341112 [details] [diff] [review]
mod-self.patch

Review of attachment 8341112 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #8341112 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/6787bcb8ea7e
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Depends on: 945860
Depends on: 946478
Depends on: 946234
Depends on: 951988
You need to log in before you can comment on or make changes to this bug.