1113744 - Assertion failure: isInt32(), at dist/include/js/Value.h

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

// Randomly chosen test: js/src/jit-test/tests/TypedObject/bug953111.js
A = TypedObject.uint8.array(0);
a = new A
TypedObject.uint8.array(0)
// Randomly chosen test: js/src/jit-test/tests/debug/Memory-drainAllocationsLog-13.js
const root = newGlobal()
root.eval("this.dbg=Debugger()").addDebuggee(this)
root.dbg.memory.trackingAllocationSites = true
// Randomly chosen test: js/src/jit-test/tests/auto-regress/bug759719.js
gczeal(2);
S = "var A = new Array(true,false)"
eval(S);
T = new Date
// Randomly chosen test: js/src/jit-test/tests/auto-regress/bug672104.js
load("a.js")

and a.js is:

a.__proto__;

asserts js debug shell on m-c changeset 1427b365cd39 with --fuzzing-safe --ion-offthread-compile=off --ion-eager at Assertion failure: isInt32(), at dist/include/js/Value.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

This was found by combining random js tests together with jsfunfuzz, the specific file(s) is/are:

http://hg.mozilla.org/mozilla-central/file/1427b365cd39/js/src/jit-test/tests/TypedObject/bug953111.js
http://hg.mozilla.org/mozilla-central/file/1427b365cd39/js/src/jit-test/tests/debug/Memory-drainAllocationsLog-13.js
http://hg.mozilla.org/mozilla-central/file/1427b365cd39/js/src/jit-test/tests/auto-regress/bug759719.js
http://hg.mozilla.org/mozilla-central/file/1427b365cd39/js/src/jit-test/tests/auto-regress/bug672104.js

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/46ae5134ab00
user:        Brian Hackett
date:        Fri Dec 12 13:36:56 2014 -0700
summary:     Bug 1107226 - Share prototype objects for typed object arrays with the same element type, r=nmatsakis.

Setting s-s because this involves gczeal(2).

Brian, is bug 1107226 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x50470, 0x0000000100108897 js-dbg-opt-64-dm-nsprBuild-darwin-1427b365cd39`js::TypeDescr::kind() const [inlined] js::NativeObject::getReservedSlot(this=<unavailable>, index=<unavailable>) const + 145 at NativeObject.h:842, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000100108897 js-dbg-opt-64-dm-nsprBuild-darwin-1427b365cd39`js::TypeDescr::kind() const [inlined] js::NativeObject::getReservedSlot(this=<unavailable>, index=<unavailable>) const + 145 at NativeObject.h:842
    frame #1: 0x0000000100108806 js-dbg-opt-64-dm-nsprBuild-darwin-1427b365cd39`js::TypeDescr::kind(this=<unavailable>) const + 86 at TypedObject.h:157
    frame #2: 0x00000001000c4ee7 js-dbg-opt-64-dm-nsprBuild-darwin-1427b365cd39`js::TypedObject::obj_getGeneric(cx=0x0000000101d01e40, obj=<unavailable>, receiver=<unavailable>, id=<unavailable>, vp=<unavailable>) + 263 at TypedObject.cpp:1813
    frame #3: 0x000000010028d4c6 js-dbg-opt-64-dm-nsprBuild-darwin-1427b365cd39`js::jit::ComputeGetPropResult(JSContext*, js::jit::BaselineFrame*, JSOp, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>) [inlined] JSObject::getGeneric(cx=0x0000000101d01e40, root=0x0000000101d01e58, root=0x0000000101d01e58, root=0x0000000101d01ea0, dummy=<unavailable>, dummy=<unavailable>) + 30 at NativeObject.h:1404
    frame #4: 0x000000010028d4a8 js-dbg-opt-64-dm-nsprBuild-darwin-1427b365cd39`js::jit::ComputeGetPropResult(cx=0x0000000101d01e40, frame=<unavailable>, op=JSOP_GETPROP, name=<unavailable>, val=<unavailable>, res=<unavailable>) + 696 at BaselineIC.cpp:6901
(lldb)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

// Randomly chosen test: js/src/jit-test/tests/TypedObject/bug953111.js
A = TypedObject.uint8.array(0);
a = new A
TypedObject.uint8.array(0)
// Randomly chosen test: js/src/jit-test/tests/debug/Memory-drainAllocationsLog-13.js
const root = newGlobal()
root.eval("this.dbg=Debugger()").addDebuggee(this)
root.dbg.memory.trackingAllocationSites = true
// Randomly chosen test: js/src/jit-test/tests/auto-regress/bug759719.js
gczeal(2);
S = "var A = new Array(true,false)"
eval(S);
T = new Date
// Randomly chosen test: js/src/jit-test/tests/auto-regress/bug672104.js
eval("a.__proto__;")

asserts js debug shell on m-c changeset b17e7747d3fb with --fuzzing-safe --ion-offthread-compile=off --ion-eager at Assertion failure: isInt32(), at dist/include/js/Value.h.

Turns out the load function is not required.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

Type descriptors attached to type objects weren't being traced (oops).

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3d2cbf625d1c

Comment 8

[Brian Hackett [Laid off!]]

Followup to fix using zone() off thread during compacting GCs.

https://hg.mozilla.org/integration/mozilla-inbound/rev/0962698c14a0

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/3d2cbf625d1c
https://hg.mozilla.org/mozilla-central/rev/0962698c14a0

Comment 10

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.