Closed Bug 1301797 Opened 3 years ago Closed 3 years ago

MOZ_CRASH("Unexpected type") in js::jit::CodeGeneratorX86::visitLoadTypedArrayElementStatic

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Windows 10
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla51
Tracking Status
firefox51 --- fixed

People

(Reporter: jchen, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-679c4130-578c-4623-8668-2e9762160909.
=============================================================

Low volume crash that started with the 09-08 nightly (regression range [1]). So far, there have been 6 crashes for the 09-08 nightly on Windows, making it the #31 crash.

Luke, could this be caused by one of the bugs you landed recently?

[1] https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=91c2b9d5c1354ca79e5b174591dbb03b32b15bbf&tochange=938ce16be25f9c551c19ef8938e8717ed3d41ff5
Flags: needinfo?(luke)
Ah crud, I just looked at the cset, and it looks like I left out Uint8Clamped when I inlined the switch (asm.js doesn't have Uint8Clamped but JS does).  Fix in a sec.
Flags: needinfo?(luke)
I tried for a while to actually reproduce this (feeding it various asm.js patterns) but the type analysis is apparently super-fickle.
Attachment #8789948 - Flags: review?(sunfish)
Comment on attachment 8789948 [details] [diff] [review]
re-add-uint8-clamped

Review of attachment 8789948 [details] [diff] [review]:
-----------------------------------------------------------------

Trivial, stealing.
Attachment #8789948 - Flags: review?(sunfish) → review+
Pushed by lwagner@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1808f8757cb0
Ion: re-add Uint8Clamped case to CodeGeneratorX86::visitLoadTypedArrayElementStatic (r=bbouvier)
https://hg.mozilla.org/mozilla-central/rev/1808f8757cb0
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
Duplicate of this bug: 1302394
I was catching up on backlog and found that jsfunfuzz actually caught this, and the issue is fixed by the patch.

new Uint8ClampedArray(4277 << 4277) + 0;

Run with --fuzzing-safe --no-threads --ion-eager on m-c rev 6138e059bacb and the following configuration command:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin14.5.0 --disable-jemalloc --enable-profiling --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Setting needinfo? from Luke in case he would like to have a testcase as per comment 2.
Flags: needinfo?(luke)
whoa, that's a fun one, thanks, I'll add it.
Flags: needinfo?(luke)
Oh hah, I see: I was stepping through the IonBuilder optimization, saw it failing on the isSingleton check and I couldn't find out how to get a singleton.  Turns out, it only works for typed arrays bigger than TypedArrayObject::SINGLETON_BYTE_LENGTH (10mb) and created via view (not ArrayBuffer).  Fragile indeed.
You need to log in before you can comment on or make changes to this bug.