987587 - Assertion failure: debugCount == count_, at jit/ValueNumbering.cpp:225

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 5c0673441fc8 (run with --fuzzing-safe --ion-eager):


assertEq((function() {
    var $1=0, $2=0, $3=0, $4=0, $5=0, $7=0, $8=0, label=0;
    while (1) {
      switch (label | 0) {
       case 1:
        $2 = $1 + 14 | 0;
        $3 +=  $1;
        break;
       case 20:
        $5 = $2;
        $4 = $3;
       case 24:
        $7 = $5 + 1 | 0;
        $8 = $4 + 1 | 0;
    }
  }
})()(), 1);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unknown exception (check manually)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140320090350" and the hash "61e72c13e60b".
The "bad" changeset has the timestamp "20140320090852" and the hash "3762c3e540cd".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=61e72c13e60b&tochange=3762c3e540cd

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 448f2153d6d3).

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "bad" changeset has the timestamp "20140522083817" and the hash "4b9f69a50b16".
The "good" changeset has the timestamp "20140522090216" and the hash "cc1bff97f035".

Likely fix window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4b9f69a50b16&tochange=cc1bff97f035

Comment 7

[Dan Gohman [:sunfish]]

This was fixed when the patch which caused it was reverted, as noted in comment 6.

The patch was reapplied along with other changes as part of bug 1004363.