1252120 - Crash [@ IntersectDominators] with PGO

Status: RESOLVED DUPLICATE of bug 1252034

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 4972f77869de (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --ion-eager --ion-pgo=on --ion-offthread-compile=off):

target = handler = {}
for (p of[new Proxy(target, handler)])
  evaluate("foo()");
function foo() {
    symbols = [Symbol]
    values = [NaN]
    for (comparator of[""])
        for (b of values) assertEq;
    for (comparator of[""])
        for (a of symbols)
            for (b of values) assertThrowsInstanceOf;
}



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00000000006da680 in IntersectDominators (block2=<optimized out>, block1=<optimized out>) at js/src/jit/IonAnalysis.cpp:1996
#0  0x00000000006da680 in IntersectDominators (block2=<optimized out>, block1=<optimized out>) at js/src/jit/IonAnalysis.cpp:1996
#1  ComputeImmediateDominators (graph=...) at js/src/jit/IonAnalysis.cpp:2061
#2  js::jit::BuildDominatorTree (graph=...) at js/src/jit/IonAnalysis.cpp:2089
#3  0x00000000006db02b in AccountForCFGChanges (updateAliasAnalysis=<optimized out>, graph=..., mir=<optimized out>) at js/src/jit/IonAnalysis.cpp:1916
#4  js::jit::RemoveUnmarkedBlocks (mir=<optimized out>, graph=..., numMarkedBlocks=numMarkedBlocks@entry=94) at js/src/jit/IonAnalysis.cpp:1973
#5  0x00000000008005ac in js::jit::ValueNumberer::cleanupOSRFixups (this=this@entry=0x7fffffffa4c0) at js/src/jit/ValueNumbering.cpp:1125
#6  0x000000000080ae88 in js::jit::ValueNumberer::run (this=this@entry=0x7fffffffa4c0, updateAliasAnalysis=updateAliasAnalysis@entry=js::jit::ValueNumberer::UpdateAliasAnalysis) at js/src/jit/ValueNumbering.cpp:1217
#7  0x0000000000692430 in js::jit::OptimizeMIR (mir=mir@entry=0x7ffff31c7270) at js/src/jit/Ion.cpp:1679
#8  0x0000000000696027 in js::jit::CompileBackEnd (mir=mir@entry=0x7ffff31c7270) at js/src/jit/Ion.cpp:1992
#9  0x000000000069969f in js::jit::IonCompile (cx=cx@entry=0x7ffff6907800, script=script@entry=0x7ffff7e6f640, baselineFrame=baselineFrame@entry=0x7fffffffabc8, osrPc=<optimized out>, constructing=<optimized out>, recompile=<optimized out>, optimizationLevel=optimizationLevel@entry=js::jit::Normal) at js/src/jit/Ion.cpp:2263
#10 0x0000000000699d20 in js::jit::Compile (cx=0x7ffff6907800, script=..., script@entry=..., osrFrame=osrFrame@entry=0x7fffffffabc8, osrPc=osrPc@entry=0x7ffff31ae947 "\343\203Q\f\f\270", constructing=<optimized out>, forceRecompile=forceRecompile@entry=false) at js/src/jit/Ion.cpp:2433
#11 0x000000000069a74a in BaselineCanEnterAtBranch (pc=0x7ffff31ae947 "\343\203Q\f\f\270", osrFrame=0x7fffffffabc8, script=..., cx=0x7ffff6907800) at js/src/jit/Ion.cpp:2620
#12 js::jit::IonCompileScriptForBaseline (cx=cx@entry=0x7ffff6907800, frame=frame@entry=0x7fffffffabc8, pc=pc@entry=0x7ffff31ae947 "\343\203Q\f\f\270") at js/src/jit/Ion.cpp:2678
#13 0x000000000060e517 in js::jit::DoWarmUpCounterFallbackOSR (cx=0x7ffff6907800, frame=0x7fffffffabc8, stub=0x7ffff69a9090, infoPtr=0x7fffffffab70) at js/src/jit/BaselineIC.cpp:141
#14 0x00007ffff7ff2679 in ?? ()
[...]
#25 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff2f02900	140737269213440
rcx	0x1	1
rdx	0x7ffff2f02598	140737269212568
rsi	0x1	1
rdi	0x5d	93
rbp	0x7fffffffa1e0	140737488331232
rsp	0x7fffffffa110	140737488331024
r8	0x4	4
r9	0x3	3
r10	0x7ffff31c0fc0	140737272090560
r11	0x0	0
r12	0x1	1
r13	0x7ffff2f028c8	140737269213384
r14	0x7ffff2f29c00	140737269373952
r15	0x1	1
rip	0x6da680 <js::jit::BuildDominatorTree(js::jit::MIRGraph&)+240>
=> 0x6da680 <js::jit::BuildDominatorTree(js::jit::MIRGraph&)+240>:	mov    0x94(%rax),%edi
   0x6da686 <js::jit::BuildDominatorTree(js::jit::MIRGraph&)+246>:	mov    %rax,%r14