1070465 - Assertion failure: tagCount > 0, at jit/CodeGenerator.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

{
    while (x && 0) {}
    let x
}

asserts js debug shell on m-c changeset c8e325eee9e1 with --ion-eager --no-threads at Assertion failure: tagCount > 0, at jit/CodeGenerator.cpp.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140915155135" and the hash "170ce237e4a0".
The "bad" changeset has the timestamp "20140915164436" and the hash "b7f4709b34c3".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=170ce237e4a0&tochange=b7f4709b34c3

Shu-yu, is bug 1001090 a possible regressor? (Guessing that bug is related because the changeset range involves that bug and also the testcase includes "let".)

Comment 1

[Shu-yu Guo [:shu]]

Attachment: Give JS_UNINITIALIZED_LEXICAL constants unknown type sets in Ion.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8492677 [details] [diff] [review]
Give JS_UNINITIALIZED_LEXICAL constants unknown type sets in Ion.

Review of attachment 8492677 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/IonBuilder.cpp
@@ +11092,5 @@
> +    // TODO We could track uninitialized lexicals more precisely by tracking
> +    // them in type sets.
> +    MConstant *c = constant(MagicValue(JS_UNINITIALIZED_LEXICAL));
> +    LifoAlloc *lifoAlloc = alloc().lifoAlloc();
> +    types::TemporaryTypeSet *unknown =

This looks a lot like what we do in MConstant::MConstant for objects. Can we move this code over there?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Shu-yu, assigning to you as you worked on the first patch. :)

Comment 5

[Shu-yu Guo [:shu]]

Attachment: Give JS_UNINITIALIZED_LEXICAL constants unknown type sets in Ion.

Good suggestion. This is much cleaner.

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 8497097 [details] [diff] [review]
Give JS_UNINITIALIZED_LEXICAL constants unknown type sets in Ion.

Review of attachment 8497097 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

Comment 7

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1b80c2b26722

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1b80c2b26722