[v8-dev] Issue 3032 in v8: Failed assertion with OSR in BuildBinaryOperation for Token::MOD

[codesite-noreply]

Status: Accepted
Owner: bmeu...@chromium.org
CC: yang...@chromium.org
Labels: Type-Bug Priority-Medium HW-All OS-All
New issue 3032 by bmeu...@chromium.org: Failed assertion with OSR in  
BuildBinaryOperation for Token::MOD
http://code.google.com/p/v8/issues/detail?id=3032

 out/ia32.debug/d8 --stress-opt --trace-osr bug.js
============ Stress 1/2 ============
[OSR - patching back edges in ]
[OSR - replacing at AST id 17 in ]
[OSR - entry at AST id 17, offset 112 in optimized code]
============ Stress 2/2 ============
[OSR - patching back edges in ]
[OSR - replacing at AST id 17 in ]


#
# Fatal error in ../src/hydrogen-instructions.h, line 3587
# CHECK(HasInteger32Value()) failed
#

==== C stack trace ===============================

 1: V8_Fatal
 2: v8::internal::HConstant::Integer32Value() const
 3:  
v8::internal::HGraphBuilder::BuildBinaryOperation(v8::internal::Token::Value,  
v8::internal::HValue*, v8::internal::HValue*,  
v8::internal::Handle<v8::internal::Type>,  
v8::internal::Handle<v8::internal::Type>,  
v8::internal::Handle<v8::internal::Type>, v8::Maybe<int>)
 4:  
v8::internal::HOptimizedGraphBuilder::BuildBinaryOperation(v8::internal::BinaryOperation*,  
v8::internal::HValue*, v8::internal::HValue*)
 5:  
v8::internal::HOptimizedGraphBuilder::VisitArithmeticExpression(v8::internal::BinaryOperation*)
 6:  
v8::internal::HOptimizedGraphBuilder::VisitBinaryOperation(v8::internal::BinaryOperation*)
 7: v8::internal::BinaryOperation::Accept(v8::internal::AstVisitor*)
 8: v8::internal::HOptimizedGraphBuilder::Visit(v8::internal::AstNode*)
 9:  
v8::internal::HOptimizedGraphBuilder::VisitForValue(v8::internal::Expression*,  
v8::internal::ArgumentsAllowedFlag)
10:  
v8::internal::HOptimizedGraphBuilder::VisitAssignment(v8::internal::Assignment*)
11: v8::internal::Assignment::Accept(v8::internal::AstVisitor*)
12: v8::internal::HOptimizedGraphBuilder::Visit(v8::internal::AstNode*)
13:  
v8::internal::HOptimizedGraphBuilder::VisitForEffect(v8::internal::Expression*)
14:  
v8::internal::HOptimizedGraphBuilder::VisitExpressionStatement(v8::internal::ExpressionStatement*)
15: v8::internal::ExpressionStatement::Accept(v8::internal::AstVisitor*)
16: v8::internal::HOptimizedGraphBuilder::Visit(v8::internal::AstNode*)
17:  
v8::internal::HOptimizedGraphBuilder::VisitStatements(v8::internal::ZoneList<v8::internal::Statement*>*)
18: v8::internal::HOptimizedGraphBuilder::VisitBlock(v8::internal::Block*)
19: v8::internal::Block::Accept(v8::internal::AstVisitor*)
20: v8::internal::HOptimizedGraphBuilder::Visit(v8::internal::AstNode*)
21:  
v8::internal::HOptimizedGraphBuilder::VisitStatements(v8::internal::ZoneList<v8::internal::Statement*>*)
22: v8::internal::HOptimizedGraphBuilder::VisitBlock(v8::internal::Block*)
23: v8::internal::Block::Accept(v8::internal::AstVisitor*)
24: v8::internal::HOptimizedGraphBuilder::Visit(v8::internal::AstNode*)
25:  
v8::internal::HOptimizedGraphBuilder::VisitLoopBody(v8::internal::IterationStatement*,  
v8::internal::HBasicBlock*,  
v8::internal::HOptimizedGraphBuilder::BreakAndContinueInfo*)
26:  
v8::internal::HOptimizedGraphBuilder::VisitForStatement(v8::internal::ForStatement*)
27: v8::internal::ForStatement::Accept(v8::internal::AstVisitor*)
28: v8::internal::HOptimizedGraphBuilder::Visit(v8::internal::AstNode*)
29:  
v8::internal::HOptimizedGraphBuilder::VisitStatements(v8::internal::ZoneList<v8::internal::Statement*>*)
30: v8::internal::HOptimizedGraphBuilder::BuildGraph()
31: v8::internal::HGraphBuilder::CreateGraph()
32: v8::internal::RecompileJob::CreateGraph()
33: ??
34: ??
35: ??
36: v8::internal::Compiler::CompileLazy(v8::internal::CompilationInfo*)
37: ??
38:  
v8::internal::JSFunction::CompileOsr(v8::internal::Handle<v8::internal::JSFunction>,  
v8::internal::BailoutId, v8::internal::ClearExceptionFlag)
39: ??
40: v8::internal::Runtime_CompileForOnStackReplacement(int,  
v8::internal::Object**, v8::internal::Isolate*)
41: ??
42: ??
43: ??
44: ??
45: ??
46: ??
47: v8::internal::Execution::Call(v8::internal::Isolate*,  
v8::internal::Handle<v8::internal::Object>,  
v8::internal::Handle<v8::internal::Object>, int,  
v8::internal::Handle<v8::internal::Object>*, bool*, bool)
48: v8::Script::Run()
49: v8::Shell::ExecuteString(v8::Isolate*, v8::Handle<v8::String>,  
v8::Handle<v8::Value>, bool, bool)
50: v8::SourceGroup::Execute(v8::Isolate*)
51: v8::Shell::RunMain(v8::Isolate*, int, char**)
52: v8::Shell::Main(int, char**)
53: main
54: __libc_start_main
Trace/breakpoint trap (core dumped)

happens with the following code:

for (var i = 0; i < 1000000; i++) { }
var x = "0123456789ABCDEF";
x += x;  // 2^5
x += x;
x += x;
x += x;
x += x;
x += x;  // 2^10
x += x;
x += x;
var xl = 4096;
for (var i = 0; i < 10000; i++) {
  var z = i % xl;
}

--
You received this message because this project is configured to send all  
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
--- 
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.