1057248 - Crash at a weird memory address or Assertion failure: [infer failure] Missing type in object [0x101d9e740] fileName: float,

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming testcase crashes js debug shell on m-c changeset cd2acc7ab2f8 from https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1408670600/jsshell-mac64.zip

I had 2 bisection results:

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140821115117" and the hash "e4886c5bea1c".
The "bad" changeset has the timestamp "20140821124919" and the hash "d0dd7f70b560".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e4886c5bea1c&tochange=d0dd7f70b560


=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140821092014" and the hash "36ffb9b24c56".
The "bad" changeset has the timestamp "20140821095114" and the hash "6b9c89464dc6".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=36ffb9b24c56&tochange=6b9c89464dc6

Nicolas / Luke, not sure which changeset is at fault here, any ideas?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

$ jsshell-mac64/js --ion-eager --ion-offthread-compile=off w90-reduced.js
Segmentation fault: 11

Comment 3

[Luke Wagner [:luke]]

Likely not directly related to asm.js.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, :nbp is away for awhile, do you think you're able to take a look?

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] work week Aug 18 - 22 from comment #4)
> Jan, :nbp is away for awhile, do you think you're able to take a look?

Yes I'm looking into this now. With --ion-eager --ion-offthread-compile=off it repros about 40% of the time for me. With --ion-eager --no-threads it also repros but a lot less frequently, about 1% of the time.

Stay tuned.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, thanks for looking at this. Unfortunately this is really annoying for the fuzzers (as there has been a deluge of fuzzing issues over the weekend), so setting [fuzzblocker].

Comment 7

[Luke Wagner [:luke]]

Oops, I only saw the first regression range in comment 0, not the second one.  Jan did most of the work to demonstrate that this was an asm.js SharedArrayBuffer-only bug (caused by the second regression range).  Fix in a sec.

Comment 8

[Luke Wagner [:luke]]

Attachment: fix-sab-bug

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Assuming sec-critical as this is an type-inference failure, and this seems to be trunk-only (see comment 7), so sec-approval is unlikely to be required.

Thanks for fixing, I hope it's alright for me to help land this to help unbreak the fuzzers for tomorrow.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2e67ec183732

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2e67ec183732

Comment 12

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.