Closed Bug 1301797 Opened 5 years ago Closed 5 years ago
_CRASH("Unexpected type") in js::jit::Code Generator X86::visit Load Typed Array Element Static
This bug was filed from the Socorro interface and is report bp-679c4130-578c-4623-8668-2e9762160909. ============================================================= Low volume crash that started with the 09-08 nightly (regression range ). So far, there have been 6 crashes for the 09-08 nightly on Windows, making it the #31 crash. Luke, could this be caused by one of the bugs you landed recently?  https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=91c2b9d5c1354ca79e5b174591dbb03b32b15bbf&tochange=938ce16be25f9c551c19ef8938e8717ed3d41ff5
Ah crud, I just looked at the cset, and it looks like I left out Uint8Clamped when I inlined the switch (asm.js doesn't have Uint8Clamped but JS does). Fix in a sec.
I tried for a while to actually reproduce this (feeding it various asm.js patterns) but the type analysis is apparently super-fickle.
Attachment #8789948 - Flags: review?(sunfish)
Comment on attachment 8789948 [details] [diff] [review] re-add-uint8-clamped Review of attachment 8789948 [details] [diff] [review]: ----------------------------------------------------------------- Trivial, stealing.
Attachment #8789948 - Flags: review?(sunfish) → review+
Pushed by email@example.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/1808f8757cb0 Ion: re-add Uint8Clamped case to CodeGeneratorX86::visitLoadTypedArrayElementStatic (r=bbouvier)
I was catching up on backlog and found that jsfunfuzz actually caught this, and the issue is fixed by the patch. new Uint8ClampedArray(4277 << 4277) + 0; Run with --fuzzing-safe --no-threads --ion-eager on m-c rev 6138e059bacb and the following configuration command: LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin14.5.0 --disable-jemalloc --enable-profiling --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests Setting needinfo? from Luke in case he would like to have a testcase as per comment 2.
whoa, that's a fun one, thanks, I'll add it.
Oh hah, I see: I was stepping through the IonBuilder optimization, saw it failing on the isSingleton check and I couldn't find out how to get a singleton. Turns out, it only works for typed arrays bigger than TypedArrayObject::SINGLETON_BYTE_LENGTH (10mb) and created via view (not ArrayBuffer). Fragile indeed.
Pushed by firstname.lastname@example.org: https://hg.mozilla.org/integration/mozilla-inbound/rev/36835c15063d add Uint8ClampedArray test (r=me)
You need to log in before you can comment on or make changes to this bug.