1151401 - Assertion failure: ndef->type() == MIRType_Object, at jit/IonAnalysis.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

s = newGlobal();
evalcx("\
    x = null;\
    f = function (z) {\
        var ff = z.ff;\
        function f() {\
            (0(ff()))\
            (ff()|0)\
        }\
        return f\
    }({\
        ff: (function() {\
            return x\
        })\
    });\
    try {\
        f()\
    } catch (e) {}\
", s);
evalcx("\
    function x() {};\
    for (var k = 0; k < 2; ++k) {\
        try {\
            f()\
        } catch (e) {}\
    }\
", s)

asserts js debug shell on m-c changeset 421548077f12 with --fuzzing-safe --no-threads --ion-eager at Assertion failure: ndef->type() == MIRType_Object, at jit/IonAnalysis.cpp.

Configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r 421548077f12

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a3cabc94db73
user:        Brian Hackett
date:        Tue Feb 17 12:30:44 2015 -0700
summary:     Bug 1131403 - Optimize additional uses of ObjectOrNull values better, r=jandem.

Brian, is bug 1131403 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x5e7de, 0x00000001004fcfe4 js-dbg-64-dm-nsprBuild-darwin-421548077f12`js::jit::EliminateRedundantChecks(js::jit::MIRGraph&) [inlined] TryOptimizeLoadObjectOrNull(peliminateList=0x00000001028da020) + 67 at IonAnalysis.cpp:2556, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00000001004fcfe4 js-dbg-64-dm-nsprBuild-darwin-421548077f12`js::jit::EliminateRedundantChecks(js::jit::MIRGraph&) [inlined] TryOptimizeLoadObjectOrNull(peliminateList=0x00000001028da020) + 67 at IonAnalysis.cpp:2556
    frame #1: 0x00000001004fcfa1 js-dbg-64-dm-nsprBuild-darwin-421548077f12`js::jit::EliminateRedundantChecks(graph=<unavailable>) + 3585 at IonAnalysis.cpp:2682
    frame #2: 0x00000001004f4539 js-dbg-64-dm-nsprBuild-darwin-421548077f12`js::jit::OptimizeMIR(mir=<unavailable>) + 5257 at Ion.cpp:1481
    frame #3: 0x0000000100501372 js-dbg-64-dm-nsprBuild-darwin-421548077f12`js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool, bool) [inlined] js::jit::CompileBackEnd(mir=0x00000001028da258, aRhs=<unavailable>) + 42 at Ion.cpp:1614
    frame #4: 0x0000000100501348 js-dbg-64-dm-nsprBuild-darwin-421548077f12`js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool, bool) [inlined] js::jit::IonCompile(cx=0x00000001028a5180, script=<unavailable>, baselineFrame=<unavailable>) + 1221 at Ion.cpp:1983
(lldb)

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 3

[Jan de Mooij [:jandem]]

Should we backport this to 38/39?

Comment 4

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/30f3ac8076dd

Comment 5

[Brian Hackett [Laid off!]]

Comment on attachment 8588789 [details] [diff] [review]
patch

Approval Request Comment
[Feature/regressing bug #]: Bug 1131403
[User impact if declined]: Potential incorrect behavior
[Describe test coverage new/current, TreeHerder]: none
[Risks and why]: none

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/30f3ac8076dd

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8588789 [details] [diff] [review]
patch

Should be in 38 beta 4.

Btw, please avoid "none"  for the risk eval. All patches have risks.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/0dcc817ca441

Can we land the test for this?

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/d2bade84e15e