960071 - Crash at SIGTRAP or Assertion failure: Integer input should be lower or equal than Upperbound., at jit/IonMacroAssembler.cpp

Status: RESOLVED DUPLICATE of bug 960145

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function() {
    for (let x = 0; x < 1; ++x) {
        try {
            return w
        } catch (e) {}
    }
})()

asserts js debug shell on m-c changeset 81bced59e8b3 with --ion-parallel-compile=off --ion-eager --ion-check-range-analysis at Assertion failure: Integer input should be lower or equal than Upperbound., at jit/IonMacroAssembler.cpp and crashes js opt shell at SIGTRAP.

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/eb804b2f1e96
user:        Andy Wingo
date:        Wed Dec 18 14:45:09 2013 +0100
summary:     Bug 942804 - Ion-compile scripts with unaliased let bindings. r=jandem

Andy, is bug 942804 a likely regressor?

Comment 1

[Andy Wingo [:wingo]]

Yes that is likely the regressor.  Thank you for the report; I'm on it after

Comment 2

[Andy Wingo [:wingo]]

...after bug 956173, that is.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Andy, bug 956173 is now fixed, so setting needinfo. :)

Comment 4

[Andy Wingo [:wingo]]

I believe that :sunfish tracked this one down in the meantime in bug 960145; at least, I've been operating under that assumption.  Please correct me if I'm wrong, sunfish :)

Comment 5

[Dan Gohman [:sunfish]]

Yes. That fixes it.