Closed
Bug 1185957
Opened 9 years ago
Closed 9 years ago
Assertion failure: !call->hasSingleTarget(), at js/src/jit/CodeGenerator.cpp:3020 with ES6 Classes
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla43
People
(Reporter: decoder, Assigned: efaust)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
3.32 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
The following testcase crashes on mozilla-central revision 3a4bfa5d2d02 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --ion-eager): class test { constructor() {}; } (function() { test() })(); Backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff5ac2700 (LWP 3407)] 0x0000000000895f07 in js::jit::CodeGenerator::visitCallGeneric (this=0x7ffff69c5000, call=0x7ffff330c830) at js/src/jit/CodeGenerator.cpp:3020 #0 0x0000000000895f07 in js::jit::CodeGenerator::visitCallGeneric (this=0x7ffff69c5000, call=0x7ffff330c830) at js/src/jit/CodeGenerator.cpp:3020 #1 0x00000000008f05c6 in js::jit::CodeGenerator::generateBody (this=this@entry=0x7ffff69c5000) at js/src/jit/CodeGenerator.cpp:4108 #2 0x00000000008f0d62 in js::jit::CodeGenerator::generate (this=this@entry=0x7ffff69c5000) at js/src/jit/CodeGenerator.cpp:7784 #3 0x00000000009231a7 in js::jit::GenerateCode (mir=mir@entry=0x7ffff330a1a8, lir=0x7ffff330bd38) at js/src/jit/Ion.cpp:1713 #4 0x0000000000985601 in js::jit::CompileBackEnd (mir=0x7ffff330a1a8) at js/src/jit/Ion.cpp:1735 #5 0x000000000067daf2 in js::HelperThread::handleIonWorkload (this=this@entry=0x7ffff696a550) at js/src/vm/HelperThreads.cpp:1127 #6 0x000000000067f347 in js::HelperThread::threadLoop (this=0x7ffff696a550) at js/src/vm/HelperThreads.cpp:1423 #7 0x00000000006ffec1 in nspr::Thread::ThreadRoutine (arg=0x7ffff6931180) at js/src/vm/PosixNSPR.cpp:45 #8 0x00007ffff7bc4182 in start_thread (arg=0x7ffff5ac2700) at pthread_create.c:312 #9 0x00007ffff6cb3fbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 rax 0x0 0 rbx 0x7ffff69c5000 140737330827264 rcx 0x7ffff6ca53cd 140737333842893 rdx 0x0 0 rsi 0x7ffff6f7a9d0 140737336814032 rdi 0x7ffff6f791c0 140737336807872 rbp 0x7ffff5ac1b20 140737315085088 rsp 0x7ffff5ac1a50 140737315084880 r8 0x7ffff5ac2700 140737315088128 r9 0x6372732f736a2f6c 7165916604736876396 r10 0x7ffff6f76be0 140737336798176 r11 0x0 0 r12 0x7ffff330c830 140737273448496 r13 0x3 3 r14 0x7ffff330c830 140737273448496 r15 0x0 0 rip 0x895f07 <js::jit::CodeGenerator::visitCallGeneric(js::jit::LCallGeneric*)+1671> => 0x895f07 <js::jit::CodeGenerator::visitCallGeneric(js::jit::LCallGeneric*)+1671>: movl $0xbcc,0x0 0x895f12 <js::jit::CodeGenerator::visitCallGeneric(js::jit::LCallGeneric*)+1682>: callq 0x498e30 <abort()>
Updated•9 years ago
|
Flags: needinfo?(efaustbmo)
See bug 1181336.
Assignee | ||
Comment 3•9 years ago
|
||
We can't just filter all cases known to throw through LCallGeneric, because it asserts that we don't do that. Make LCallKnown handle this case, but punt to the interpreter.
Assignee: nobody → efaustbmo
Status: NEW → ASSIGNED
Flags: needinfo?(efaustbmo)
Attachment #8637549 -
Flags: review?(jdemooij)
Comment 4•9 years ago
|
||
Comment on attachment 8637549 [details] [diff] [review] Fix Review of attachment 8637549 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit-test/tests/ion/bug1185957.js @@ +9,5 @@ > +})(); > +`; > + > +if (classesEnabled()) > + eval(test); This test needs a try-catch or `// |jit-test| error: FOO` line right? ::: js/src/jit/CodeGenerator.cpp @@ +3141,5 @@ > + emitCallInvokeFunction(call, calleereg, call->isConstructing(), call->numActualArgs(), unusedStack); > + return; > + } > + > + MOZ_ASSERT_IF(target->isClassConstructor(), call->isConstructing()); Seems we can remove this assert since it follows directly from the if-condition above. If you think it's still useful it's fine to keep it tho.
Attachment #8637549 -
Flags: review?(jdemooij) → review+
Comment 5•9 years ago
|
||
(In reply to Jan de Mooij [:jandem] from comment #4) > This test needs a try-catch or `// |jit-test| error: FOO` line right? ... and the latter won't work in the !classesEnabled() case...
https://hg.mozilla.org/mozilla-central/rev/17a2a99cf8fd
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
status-firefox43:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
Updated•9 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
You need to log in
before you can comment on or make changes to this bug.
Description
•