1307523 - Assertion failure: hasInt32UpperBound(), or Assertion failure: hasInt32LowerBound(), at js/src/jit/RangeAnalysis.h:572

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 42c95d88aaaa (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

(function() {
    x % (2147483647 >>> 0) ? 1 : 0
})()


Backtrace:

0   js-dbg-64-dm-clang-darwin-42c95d88aaaa	0x000000010bb38f93 js::jit::MMod::computeRange(js::jit::TempAllocator&) + 1155 (RangeAnalysis.h:572)
1   js-dbg-64-dm-clang-darwin-42c95d88aaaa	0x000000010bb3bc19 js::jit::RangeAnalysis::analyze() + 249 (MIR.h:706)
2   js-dbg-64-dm-clang-darwin-42c95d88aaaa	0x000000010b9c6a8c js::jit::OptimizeMIR(js::jit::MIRGenerator*) + 4092 (Ion.cpp:1714)
3   js-dbg-64-dm-clang-darwin-42c95d88aaaa	0x000000010b9d2c1a js::jit::CompileBackEnd(js::jit::MIRGenerator*) + 74 (Ion.cpp:2008)
4   js-dbg-64-dm-clang-darwin-42c95d88aaaa	0x000000010b9d4a53 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool, bool) + 3827 (Ion.cpp:2289)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/6e75141df030
user:        Sander Mathijs van Veen
date:        Mon Oct 03 02:36:00 2016 -0400
summary:     Bug 1302367 - Use unsigned integer modulo instead of ModD opcode. r=nbp, r=jandem

Sander, is bug 1302367 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Note that this is a fuzzblocker. "Assertion failure: hasInt32UpperBound()," may be a related assertion failure.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7d42989271c4
Backed out changeset 6e75141df030, rs=jandem over IRC

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Unfortunately it's such a severe fuzzblocker that we've had to back it out.

Comment 6

[Sander Mathijs van Veen]

Yes, that looks related to the patch.

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7d42989271c4

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The testcase would have been "fixed" by the backout, updating jsbugmon parameters.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Please also first request fuzzing for the updated patch by setting feedback? from me and/or :decoder to ensure we have a stable patch going in.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The patch was backed out, and bug 1302367 was re-fixed and re-landed several days later. Shall we marked this as FIXED?

Comment 11

[Sander Mathijs van Veen]

This is fixed indeed

Comment 12

[Firefox Bug Husbandry Bot]

Removing leave-open keyword from resolved bugs, per :sylvestre.