1102329 - Assertion failure: this->is<T>(), at jsobj.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

// Random chosen test: js/src/jit-test/tests/basic/function-bind.js
A = Array.bind()
// Random chosen test: js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js
var {
    StructType
} = TypedObject
var A = new StructType({});
(function() {
    new A
    for (var i = 0; i < 9; i++) {}
})()

asserts js debug shell on m-c changeset 7d17b594834f with --fuzzing-safe --ion-eager --no-threads at Assertion failure: this->is<T>(), at jsobj.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

This was found by combining random jit-tests together with jsfunfuzz, the specific file(s) is/are:

http://hg.mozilla.org/mozilla-central/file/7d17b594834f/js/src/jit-test/tests/basic/function-bind.js
http://hg.mozilla.org/mozilla-central/file/7d17b594834f/js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20141104140142" and the hash "a9a7f16c817b".
The "bad" changeset has the timestamp "20141104142049" and the hash "ed6401282c18".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a9a7f16c817b&tochange=ed6401282c18

Brian, is bug 1091015 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x1f61bb, 0x00000001002d7787 js-dbg-opt-64-dm-nsprBuild-darwin-7d17b594834f`js::jit::IonBuilder::inlineCalls(this=<unavailable>, callInfo=<unavailable>, targets=<unavailable>, originals=<unavailable>, choiceSet=<unavailable>, maybeCache=<unavailable>) + 3639 at IonBuilder.cpp:4908, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00000001002d7787 js-dbg-opt-64-dm-nsprBuild-darwin-7d17b594834f`js::jit::IonBuilder::inlineCalls(this=<unavailable>, callInfo=<unavailable>, targets=<unavailable>, originals=<unavailable>, choiceSet=<unavailable>, maybeCache=<unavailable>) + 3639 at IonBuilder.cpp:4908
    frame #1: 0x00000001002d67f0 js-dbg-opt-64-dm-nsprBuild-darwin-7d17b594834f`js::jit::IonBuilder::inlineCallsite(this=0x0000000103047a58, targets=0x00007fff5fbfd960, originals=0x00007fff5fbfd9b8, lambda=<unavailable>, callInfo=0x00007fff5fbfd8d0) + 256 at IonBuilder.cpp:4772
    frame #2: 0x00000001002cac69 js-dbg-opt-64-dm-nsprBuild-darwin-7d17b594834f`js::jit::IonBuilder::jsop_call(this=0x0000000103047a58, argc=<unavailable>, constructing=<unavailable>) + 1241 at IonBuilder.cpp:5559
    frame #3: 0x00000001002c2446 js-dbg-opt-64-dm-nsprBuild-darwin-7d17b594834f`js::jit::IonBuilder::inspectOpcode(this=0x0000000103047a58, op=<unavailable>) + 1174 at IonBuilder.cpp:1662
    frame #4: 0x00000001002bf776 js-dbg-opt-64-dm-nsprBuild-darwin-7d17b594834f`js::jit::IonBuilder::traverseBytecode(this=0x0000000103047a58) + 662 at IonBuilder.cpp:1336
(lldb)

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Bleah, again.  I went through IonBuilder.cpp and related files and this is the only JSFunction downcast that wasn't checked (either explicitly or via choiceSet.)  It would be nice if we were using JSObject instead of JSFunction throughout the inlining code but it would be a fair amount of work and wouldn't I think open up new optimization possibilities that are worth considering.]

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/05b7e79b688e

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/05b7e79b688e