1301797 - MOZ_CRASH("Unexpected type") in js::jit::CodeGeneratorX86::visitLoadTypedArrayElementStatic

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[(inactive) Jim Chen [:jchen] [:darchons]]

This bug was filed from the Socorro interface and is 
report bp-679c4130-578c-4623-8668-2e9762160909.
=============================================================

Low volume crash that started with the 09-08 nightly (regression range [1]). So far, there have been 6 crashes for the 09-08 nightly on Windows, making it the #31 crash.

Luke, could this be caused by one of the bugs you landed recently?

[1] https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=91c2b9d5c1354ca79e5b174591dbb03b32b15bbf&tochange=938ce16be25f9c551c19ef8938e8717ed3d41ff5

Comment 1

[Luke Wagner [:luke]]

Ah crud, I just looked at the cset, and it looks like I left out Uint8Clamped when I inlined the switch (asm.js doesn't have Uint8Clamped but JS does).  Fix in a sec.

Comment 2

[Luke Wagner [:luke]]

Attachment: re-add-uint8-clamped

I tried for a while to actually reproduce this (feeding it various asm.js patterns) but the type analysis is apparently super-fickle.

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8789948 [details] [diff] [review]
re-add-uint8-clamped

Review of attachment 8789948 [details] [diff] [review]:
-----------------------------------------------------------------

Trivial, stealing.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1808f8757cb0
Ion: re-add Uint8Clamped case to CodeGeneratorX86::visitLoadTypedArrayElementStatic (r=bbouvier)

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1808f8757cb0

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I was catching up on backlog and found that jsfunfuzz actually caught this, and the issue is fixed by the patch.

new Uint8ClampedArray(4277 << 4277) + 0;

Run with --fuzzing-safe --no-threads --ion-eager on m-c rev 6138e059bacb and the following configuration command:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin14.5.0 --disable-jemalloc --enable-profiling --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Setting needinfo? from Luke in case he would like to have a testcase as per comment 2.

Comment 8

[Luke Wagner [:luke]]

whoa, that's a fun one, thanks, I'll add it.

Comment 9

[Luke Wagner [:luke]]

Oh hah, I see: I was stepping through the IonBuilder optimization, saw it failing on the isSingleton check and I couldn't find out how to get a singleton.  Turns out, it only works for typed arrays bigger than TypedArrayObject::SINGLETON_BYTE_LENGTH (10mb) and created via view (not ArrayBuffer).  Fragile indeed.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/36835c15063d
add Uint8ClampedArray test (r=me)

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/36835c15063d

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/36835c15063d