944963 - Assertion failure: !minimalInterval(interval), at jit/BacktrackingAllocator.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f(x, y) {
    (+(xy))(y % y)
}
for (var i = 0; i < 9999; i++) {
    try {
        (function() {
            f(0, (~Math.fround(-8)))
        })()
    } catch (e) {}
}

asserts js debug shell on m-c changeset a5e7f611546f with  at Assertion failure: !minimalInterval(interval), at jit/BacktrackingAllocator.cpp

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/e14cd09c843e
user:        Dan Gohman
date:        Tue Nov 26 14:40:55 2013 -0800
summary:     Bug 942236 - IonMonkey: Unsigned optimizations for MMod, MDiv, and MUrsh. r=nbp

Dan, is bug 942236 a likely regressor?

Comment 1

[Dan Gohman [:sunfish]]

Attachment: mod-self.patch

Mod has the same problem as Div on x86. This patch introduces a new LModSelf operator, similar to the LDivSelf operator, for doing a modulo of a value by itself, in order to avoid the tricky register allocation constraints.

This replaces the trick of doing an extra copy at the beginning of visitModI, and promotes more consistency between Mod and Div, and between signed and unsigned.

It also adds some tests, and consolidates some existing test cases for similar bugs into a single file.

Comment 2

[Brian Hackett [Laid off!]]

Comment on attachment 8341112 [details] [diff] [review]
mod-self.patch

Review of attachment 8341112 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

Comment 3

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6787bcb8ea7e

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/6787bcb8ea7e

Comment 5

[Ioana (away)]

https://hg.mozilla.org/mozilla-central/diff/6787bcb8ea7e/js/src/jit-test/tests/ion/divmodself.js