1174322 - Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at jit/Recover.cpp

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(y) {
    Math.min(NaN) ? a : y
}
function g(y) {
    f({
        e: false
    })
}
x = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
for (var j = 0; j < 23; ++j) {
    g(x[j])
}

asserts js debug shell on m-c changeset 203e1025a826 with --fuzzing-safe --no-threads --ion-eager at Assertion failure: (object->as<UnboxedPlainObject>().setValue(cx, properties[i], val)), at jit/Recover.cpp.

Configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r 203e1025a826

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/46958967c522
user:        Nicolas B. Pierron
date:        Thu Jun 11 14:30:33 2015 +0200
summary:     Bug 1166711 part 2.5 - ScalarReplacement: Replace M{Store,Load}UnboxedScalar by an offset on the MObjectState. r=bhackett

Nicolas, is bug 1166711 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x14a036, 0x0000000100658c25 js-dbg-64-dm-nsprBuild-darwin-203e1025a826`js::jit::RObjectState::recover(this=<unavailable>, cx=0x0000000101fa5180, iter=<unavailable>) const + 693 at Recover.cpp:1386, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000100658c25 js-dbg-64-dm-nsprBuild-darwin-203e1025a826`js::jit::RObjectState::recover(this=<unavailable>, cx=0x0000000101fa5180, iter=<unavailable>) const + 693 at Recover.cpp:1386
    frame #1: 0x000000010058ee13 js-dbg-64-dm-nsprBuild-darwin-203e1025a826`js::jit::SnapshotIterator::computeInstructionResults(this=<unavailable>, cx=0x0000000101fa5180, results=0x00007fff5fbfec58) const + 307 at JitFrames.cpp:2257
    frame #2: 0x000000010058e36d js-dbg-64-dm-nsprBuild-darwin-203e1025a826`js::jit::SnapshotIterator::initInstructionResults(this=0x00007fff5fbfe0c8, fallback=0x00007fff5fbfdfb8) + 477 at JitFrames.cpp:2211
    frame #3: 0x00000001004437d7 js-dbg-64-dm-nsprBuild-darwin-203e1025a826`js::jit::BailoutIonToBaseline(JSContext*, js::jit::JitActivation*, js::jit::JitFrameIterator&, bool, js::jit::BaselineBailoutInfo**, js::jit::ExceptionBailoutInfo const*) [inlined] SnapshotIteratorForBailout::init(this=<unavailable>) + 60 at BaselineBailouts.cpp:436
    frame #4: 0x000000010044379b js-dbg-64-dm-nsprBuild-darwin-203e1025a826`js::jit::BailoutIonToBaseline(cx=0x0000000101fa5180, activation=<unavailable>, iter=0x00007fff5fbfe460, invalidate=false, bailoutInfo=0x00007fff5fbfe798, excInfo=0x0000000000000000) + 603 at BaselineBailouts.cpp:1478
(lldb)

Comment 2

[Nicolas B. Pierron [:nbp]]

I'll investigate now.

Comment 3

[Nicolas B. Pierron [:nbp]]

So far I cannot reproduce, I will try with other bug which have similar signature.

Comment 4

[Nicolas B. Pierron [:nbp]]

Ok, I was able to reproduce this issue, apparently MStoreUnboxedScalar coerce the boolean operands to an Int32, which cause the setValue() call within the recover instruction to be called with an int while the property was expected to be a boolean.

Comment 5

[Nicolas B. Pierron [:nbp]]

Attachment: RObjectState::recover: Work-around the lack of MStoreUnboxedBoolean.

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f9c16fa4852c

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f9c16fa4852c

Comment 8

[Carsten Book [:Tomcat]]

backed out by nbp in https://hg.mozilla.org/mozilla-central/rev/b772e603c42f

Comment 9

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 56e207dbb3bd).

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Carsten Book [:Tomcat] from comment #8)
> backed out by nbp in https://hg.mozilla.org/mozilla-central/rev/b772e603c42f

Nicolas, is this bug still relevant since bug 1165348 is now WONTFIX'ed?

Comment 11

[Nicolas B. Pierron [:nbp]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #10)
> (In reply to Carsten Book [:Tomcat] from comment #8)
> > backed out by nbp in https://hg.mozilla.org/mozilla-central/rev/b772e603c42f
> 
> Nicolas, is this bug still relevant since bug 1165348 is now WONTFIX'ed?

No, this bug is no longer relevant anymore.
Thanks.