Closed Bug 1185957 Opened 9 years ago Closed 9 years ago

Assertion failure: !call->hasSingleTarget(), at js/src/jit/CodeGenerator.cpp:3020 with ES6 Classes

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla43
Tracking Status
firefox42 --- affected
firefox43 --- fixed

People

(Reporter: decoder, Assigned: efaust)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase crashes on mozilla-central revision 3a4bfa5d2d02 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --ion-eager): class test { constructor() {}; } (function() { test() })(); Backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff5ac2700 (LWP 3407)] 0x0000000000895f07 in js::jit::CodeGenerator::visitCallGeneric (this=0x7ffff69c5000, call=0x7ffff330c830) at js/src/jit/CodeGenerator.cpp:3020 #0 0x0000000000895f07 in js::jit::CodeGenerator::visitCallGeneric (this=0x7ffff69c5000, call=0x7ffff330c830) at js/src/jit/CodeGenerator.cpp:3020 #1 0x00000000008f05c6 in js::jit::CodeGenerator::generateBody (this=this@entry=0x7ffff69c5000) at js/src/jit/CodeGenerator.cpp:4108 #2 0x00000000008f0d62 in js::jit::CodeGenerator::generate (this=this@entry=0x7ffff69c5000) at js/src/jit/CodeGenerator.cpp:7784 #3 0x00000000009231a7 in js::jit::GenerateCode (mir=mir@entry=0x7ffff330a1a8, lir=0x7ffff330bd38) at js/src/jit/Ion.cpp:1713 #4 0x0000000000985601 in js::jit::CompileBackEnd (mir=0x7ffff330a1a8) at js/src/jit/Ion.cpp:1735 #5 0x000000000067daf2 in js::HelperThread::handleIonWorkload (this=this@entry=0x7ffff696a550) at js/src/vm/HelperThreads.cpp:1127 #6 0x000000000067f347 in js::HelperThread::threadLoop (this=0x7ffff696a550) at js/src/vm/HelperThreads.cpp:1423 #7 0x00000000006ffec1 in nspr::Thread::ThreadRoutine (arg=0x7ffff6931180) at js/src/vm/PosixNSPR.cpp:45 #8 0x00007ffff7bc4182 in start_thread (arg=0x7ffff5ac2700) at pthread_create.c:312 #9 0x00007ffff6cb3fbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 rax 0x0 0 rbx 0x7ffff69c5000 140737330827264 rcx 0x7ffff6ca53cd 140737333842893 rdx 0x0 0 rsi 0x7ffff6f7a9d0 140737336814032 rdi 0x7ffff6f791c0 140737336807872 rbp 0x7ffff5ac1b20 140737315085088 rsp 0x7ffff5ac1a50 140737315084880 r8 0x7ffff5ac2700 140737315088128 r9 0x6372732f736a2f6c 7165916604736876396 r10 0x7ffff6f76be0 140737336798176 r11 0x0 0 r12 0x7ffff330c830 140737273448496 r13 0x3 3 r14 0x7ffff330c830 140737273448496 r15 0x0 0 rip 0x895f07 <js::jit::CodeGenerator::visitCallGeneric(js::jit::LCallGeneric*)+1671> => 0x895f07 <js::jit::CodeGenerator::visitCallGeneric(js::jit::LCallGeneric*)+1671>: movl $0xbcc,0x0 0x895f12 <js::jit::CodeGenerator::visitCallGeneric(js::jit::LCallGeneric*)+1682>: callq 0x498e30 <abort()>
Flags: needinfo?(efaustbmo)
Attached patch FixSplinter Review
We can't just filter all cases known to throw through LCallGeneric, because it asserts that we don't do that. Make LCallKnown handle this case, but punt to the interpreter.
Assignee: nobody → efaustbmo
Status: NEW → ASSIGNED
Flags: needinfo?(efaustbmo)
Attachment #8637549 - Flags: review?(jdemooij)
Comment on attachment 8637549 [details] [diff] [review] Fix Review of attachment 8637549 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit-test/tests/ion/bug1185957.js @@ +9,5 @@ > +})(); > +`; > + > +if (classesEnabled()) > + eval(test); This test needs a try-catch or `// |jit-test| error: FOO` line right? ::: js/src/jit/CodeGenerator.cpp @@ +3141,5 @@ > + emitCallInvokeFunction(call, calleereg, call->isConstructing(), call->numActualArgs(), unusedStack); > + return; > + } > + > + MOZ_ASSERT_IF(target->isClassConstructor(), call->isConstructing()); Seems we can remove this assert since it follows directly from the if-condition above. If you think it's still useful it's fine to keep it tho.
Attachment #8637549 - Flags: review?(jdemooij) → review+
(In reply to Jan de Mooij [:jandem] from comment #4) > This test needs a try-catch or `// |jit-test| error: FOO` line right? ... and the latter won't work in the !classesEnabled() case...
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: