1190147 - Assertion failure: Incompatible write to unboxed property, at jit/MacroAssembler.cpp

Status: RESOLVED DUPLICATE of bug 1190272

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

gczeal(14);
function m(f, x) {
    var y = [];
    for (var j = 0; j < 24; j++) {
        for (var k = 0; k < 24; k++) {
            y.push(f());
        }
    }
}
try {
    function f() {
        return 0;
    }
} catch (e) {}
function g() {
    return Math.cos(0);
}
m(g, []);
for (let w of []) {}
m(f, []);
h = function(x) {
    return Math.imul(x);
};
m(h, []);

asserts js debug shell on m-c changeset afa67b6957bb with --fuzzing-safe --no-threads --baseline-eager --unboxed-arrays at Assertion failure: Incompatible write to unboxed property, at jit/MacroAssembler.cpp

Configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r afa67b6957bb

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/57dce88fc620
user:        Brian Hackett
date:        Tue May 26 16:29:19 2015 -0600
summary:     Bug 1165392, Bug 1165463 - Various unboxed array fixes and optimizations, r=jandem.

This iteration took 216.055 seconds to run.

Brian, is bug 1165392 or bug 1165463 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt
* thread #1: tid = 0x1d9337, 0x0000000103c06497, queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=EXC_I386_BPT, subcode=0x0)
  * frame #0: 0x0000000103c06497
(lldb)