Closed Bug 1301797 Opened 5 years ago Closed 5 years ago

MOZ_CRASH("Unexpected type") in js::jit::CodeGeneratorX86::visitLoadTypedArrayElementStatic


(Core :: JavaScript Engine, defect)

Windows 10
Not set



Tracking Status
firefox51 --- fixed


(Reporter: jchen, Unassigned)



(Keywords: crash)

Crash Data


(1 file)

This bug was filed from the Socorro interface and is 
report bp-679c4130-578c-4623-8668-2e9762160909.

Low volume crash that started with the 09-08 nightly (regression range [1]). So far, there have been 6 crashes for the 09-08 nightly on Windows, making it the #31 crash.

Luke, could this be caused by one of the bugs you landed recently?

Flags: needinfo?(luke)
Ah crud, I just looked at the cset, and it looks like I left out Uint8Clamped when I inlined the switch (asm.js doesn't have Uint8Clamped but JS does).  Fix in a sec.
Flags: needinfo?(luke)
I tried for a while to actually reproduce this (feeding it various asm.js patterns) but the type analysis is apparently super-fickle.
Attachment #8789948 - Flags: review?(sunfish)
Comment on attachment 8789948 [details] [diff] [review]

Review of attachment 8789948 [details] [diff] [review]:

Trivial, stealing.
Attachment #8789948 - Flags: review?(sunfish) → review+
Pushed by
Ion: re-add Uint8Clamped case to CodeGeneratorX86::visitLoadTypedArrayElementStatic (r=bbouvier)
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
Duplicate of this bug: 1302394
I was catching up on backlog and found that jsfunfuzz actually caught this, and the issue is fixed by the patch.

new Uint8ClampedArray(4277 << 4277) + 0;

Run with --fuzzing-safe --no-threads --ion-eager on m-c rev 6138e059bacb and the following configuration command:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin14.5.0 --disable-jemalloc --enable-profiling --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Setting needinfo? from Luke in case he would like to have a testcase as per comment 2.
Flags: needinfo?(luke)
whoa, that's a fun one, thanks, I'll add it.
Flags: needinfo?(luke)
Oh hah, I see: I was stepping through the IonBuilder optimization, saw it failing on the isSingleton check and I couldn't find out how to get a singleton.  Turns out, it only works for typed arrays bigger than TypedArrayObject::SINGLETON_BYTE_LENGTH (10mb) and created via view (not ArrayBuffer).  Fragile indeed.
You need to log in before you can comment on or make changes to this bug.