1032264 - Assertion failure: end-of-block assumed unreachable, at jit/IonMacroAssembler.cpp:1314 or SIGTRAP

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision b6408c32a170 (threadsafe build, run with --fuzzing-safe --thread-count=2):


for (var a = 0; a < 2000; a++) {
  Array.buildPar(500, (function() {
    try {
      throw a;
    } catch (Infinity) {}
  }));
}

Comment 1

[Christian Holler (:decoder)]

This crashes on the heap with SIGTRAP, in debug builds it also emits the mentioned assertion before doing so. Marked s-s because this seems like some out-of-range problem, possibly jumping where we shouldn't. It might be possible to not only hit SIGTRAP but maybe also something useful for exploiting.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another testcase without the for loop:

Array.buildPar(16427, function(x) {
    if (x % 633 == 503) {
        throw x;
    }
});

$ ./js-dbg-opt-64-prof-ts-darwin-b6408c32a170 --ion-offthread-compile=off --ion-eager w109-reduced.js
Assertion failure: end-of-block assumed unreachable, at /Users/skywalker/trees/mozilla-central/js/src/jit/IonMacroAssembler.cpp:1314
Trace/BPT trap: 5

Tested on m-c rev b6408c32a170.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a0fca95e6e0f
user:        Shu-yu Guo
date:        Fri Jun 20 18:39:14 2014 -0700
summary:     Bug 1019304 - Part 4: Add MUnreachable to end basic blocks that have bails in them. (r=sunfish)

Shu-yu, is bug 1019304 a likely regressor?

Comment 3

[Shu-yu Guo [:shu]]

Attachment: Fix converting MThrow in ParallelSafetyAnalysis.

Stupid mistake on my part. Forgot to add the MBail to the bblock.

Comment 4

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9b64b4c85015

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9b64b4c85015

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.