Closed Bug 980368 Opened 9 years ago Closed 9 years ago

Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Unknown SIMD MIR Type)), at jit/MCallOptimize.cpp:290

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [fuzzblocker] [jsbugmon:update,ignore]) 

The following testcase asserts on mozilla-central revision 8122ffa9e1aa (run with --fuzzing-safe --ion-eager):


var int32x4 = SIMD.int32x4;
function test() {
  var a = int32x4(1, 2, 3, 0xaa);
  var x = SIMD.int32x4.withFlagX(a, true);
}
test();
test();
Niko, this is a fuzzblocker, can you take a look?
Flags: needinfo?(nmatsakis)
Whiteboard: [jsbugmon:update,bisect][fuzzblocker]
Blocks: 943769
Whiteboard: [jsbugmon:update,bisect][fuzzblocker] → [fuzzblocker] [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/7efaabf97f0c
user:        Haitao Feng
date:        Tue Mar 04 20:06:26 2014 -0500
summary:     Bug 943769 Part 2 -- Set up SIMD inlining infrastructure r=nmatsakis

This iteration took 344.620 seconds to run.
Whiteboard: [fuzzblocker] [jsbugmon:update] → [fuzzblocker] [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0dc1be930880).
This was due to the incomplete patch that was backed out.
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(nmatsakis)
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.