Assertion failure: activeParallelEntryScripts_ && activeParallelEntryScripts_->has(script), at jit/Ion.cpp:528

RESOLVED FIXED in mozilla33

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: shu)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla33
x86_64
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(firefox33 affected)

Details

(Whiteboard: [jsbugmon:update,bisect])

Attachments

(2 attachments)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision b6408c32a170 (threadsafe build, run with --fuzzing-safe --thread-count=2):


verifyprebarriers();
assertArraySeqParResultsEq(range(0, 1024), "filter", function(i) { return i <= ("lbs") || i >= (33); });
function range(n, m) {
  var result = [];
  for (var i = n; i < m; i++)
    result.push(i);
  return result;
}
function assertParallelExecSucceeds(opFunction, cmpFunction) {
  while (true) {
    var result = opFunction({mode:"compile"});
    try {
      var result = opFunction({mode:"par"});
    } catch (e) {}
  }
}
function assertArraySeqParResultsEq(arr, op, func, cmpFunc) {
  assertParallelExecSucceeds(
    function (m) { return arr[op + "Par"].apply(arr, [func, m]); },
    function (r) { cmpFunc(expected, r); });
}
(Reporter)

Comment 1

4 years ago
Created attachment 8448065 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

4 years ago
status-firefox33: --- → affected
Whiteboard: [jsbugmon:update,bisect]
(Assignee)

Comment 2

4 years ago
Created attachment 8448152 [details] [diff] [review]
Clear isParallelEntryScript when removing from table.

Oops, my bad. Previously, once an IonScript was marked as a
parallelEntryScript, it would be marked as such until the IonScript was
destroyed. With simplifications to the heuristics recently, a
parallelEntryScript could be removed from the parallel entry scripts table
before it's actually swept.

Fix this by adding the ability to unmark IonScripts as parallel entry scripts.
Attachment #8448152 - Flags: review?(terrence)
(Assignee)

Updated

4 years ago
Assignee: nobody → shu
Status: NEW → ASSIGNED
Attachment #8448152 - Flags: review?(terrence) → review+
https://hg.mozilla.org/mozilla-central/rev/c9834e89efe8
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.