Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Invalid BailoutKind), at vm/ForkJoin.cpp

RESOLVED FIXED in mozilla33

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: gkw, Assigned: shu)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla33
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:bisectfix])

Attachments

(2 attachments)

(Reporter)

Description

4 years ago
Created attachment 8454689 [details]
stack

x = Array.buildPar(7, Symbol);
Array.prototype.push.call(x, 2);
x.mapPar(function(){}, 1)

asserts js debug shell on m-c changeset 84bd8d9f4256 with --ion-eager --ion-offthread-compile=off at Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Invalid BailoutKind), at vm/ForkJoin.cpp

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140626231828" and the hash "8f83a0ab5060".
The "bad" changeset has the timestamp "20140627003628" and the hash "72a548ec4f56".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8f83a0ab5060&tochange=72a548ec4f56

Shu-yu, is bug 1028331 a likely regressor, or did it just expose it?
Flags: needinfo?(shu)
(Assignee)

Comment 1

4 years ago
Caused by bug 645416 part 6, which added a new BailoutKind along with the JIT machinery for Symbols.
Flags: needinfo?(shu)
(Assignee)

Comment 2

4 years ago
Created attachment 8454755 [details] [diff] [review]
Handle Bailout_NonSymbolInput in PJS bailout warnings.
Attachment #8454755 - Flags: review?(jorendorff)
(Assignee)

Updated

4 years ago
Assignee: nobody → shu
Status: NEW → ASSIGNED
(Reporter)

Updated

4 years ago
Blocks: 645416
No longer blocks: 1028331
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision b0701d069bf9).
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Comment on attachment 8454755 [details] [diff] [review]
Handle Bailout_NonSymbolInput in PJS bailout warnings.

Review of attachment 8454755 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/ForkJoin.cpp
@@ +1114,5 @@
>        case Bailout_NonStringInput:
>        case Bailout_NonStringInputInvalidate:
>          return "can't unbox: expected string";
> +      case Bailout_NonSymbolInput:
> +        return "can't unbox: expected symbol";

Darn it. Sorry. :(
Attachment #8454755 - Flags: review?(jorendorff) → review+
https://hg.mozilla.org/mozilla-central/rev/734231b3e382
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.