Assertion failure: isInterpretedLazy() && u.i.s.lazy_, at js/src/jsfun.h:442

RESOLVED FIXED in Firefox 52

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: gkw, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, jsbugmon, testcase})

Trunk
mozilla52
x86_64
Mac OS X
assertion, jsbugmon, testcase
Points:
---

Firefox Tracking Flags

(firefox52 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

2 years ago
The following testcase crashes on mozilla-central revision 7be6b348c431 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads):

function g01(x) {
    if (x < 0) {
        return function() {};
    }
    function f() {};
    "z01" + function() {} + g01(x - 1) + g01(x - 1);
}
for (var i = 0; i < 378; ++i) {
    try {
        undefined();
    } catch (e) {}
}
enableSPSProfiling();
gcparam("maxBytes", gcparam("gcBytes") + 1);
var x01 = new Int32Array();
this.f01 = function() {};
this.f02 = function() {
    var x02 = x03;
}
function f03() {};
g01(3);
s = newGlobal();
evalcx("class f{}; var d = new f;", s);
g01(3);
evalcx("for (var i = 0; i < 197; ++i) { +d; }", s);


Backtrace:

0   js-dbg-64-dm-clang-darwin-7be6b348c431	0x0000000103d0aa32 js::jit::WriteIonTrackedOptimizationsTable(JSContext*, js::jit::CompactBufferWriter&, js::jit::NativeToTrackedOptimizations const*, js::jit::NativeToTrackedOptimizations const*, js::jit::UniqueTrackedOptimizations const&, unsigned int*, unsigned int*, unsigned int*, unsigned int*, mozilla::Vector<js::jit::IonTrackedTypeWithAddendum, 1ul, js::SystemAllocPolicy>*) + 3186 (jsfun.h:442)
1   js-dbg-64-dm-clang-darwin-7be6b348c431	0x0000000103ddfa7c js::jit::CodeGeneratorShared::generateCompactTrackedOptimizationsMap(JSContext*, js::jit::JitCode*, mozilla::Vector<js::jit::IonTrackedTypeWithAddendum, 1ul, js::SystemAllocPolicy>*) + 556 (CodeGenerator-shared.cpp:896)
2   js-dbg-64-dm-clang-darwin-7be6b348c431	0x0000000103b72e4d js::jit::CodeGenerator::link(JSContext*, js::CompilerConstraintList*) + 1597 (CodeGenerator.cpp:9499)
3   js-dbg-64-dm-clang-darwin-7be6b348c431	0x0000000103bb9cf0 LinkCodeGen(JSContext*, js::jit::IonBuilder*, js::jit::CodeGenerator*) + 304 (Ion.cpp:522)
/snip

For detailed crash information, see attachment.

Setting s-s pending more triage, this seems to involve enableSPSProfiling, but may also be benign since it seems to crash at null.
(Reporter)

Comment 1

2 years ago
Created attachment 8799701 [details]
Detailed Crash Information
(Reporter)

Comment 2

2 years ago
Setting needinfo? from Jan as a start.

autoBisect is running...
Flags: needinfo?(jdemooij)
(Reporter)

Comment 3

2 years ago
I got different results so hopefully these help to triage:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d128c9990a76
parent:      311975:3d9cabea1e56
user:        Jan de Mooij
date:        Wed Aug 31 10:58:15 2016 +0200
summary:     Bug 1298878 - Don't store the actual builtin constructor properties on the global in reserved slots. r=Waldo

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a6506191e894
user:        André Bargull
date:        Wed Oct 05 03:25:57 2016 -0700
summary:     Bug 1130636 - Reimplement Array.prototype.toLocaleString as per ECMA-402, 2nd edition. r=Waldo

Note that the first instance of this bug showed up around 20 Sept 2016, so I'm not sure if the latter is relevant...
(Assignee)

Comment 4

2 years ago
Not s-s, a problem with JIT debug spew.
Group: javascript-core-security
(Assignee)

Comment 5

2 years ago
Created attachment 8800161 [details] [diff] [review]
Patch

Handle lazy self-hosted functions in SpewConstructor.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8800161 - Flags: review?(shu)

Comment 6

2 years ago
Comment on attachment 8800161 [details] [diff] [review]
Patch

Review of attachment 8800161 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #8800161 - Flags: review?(shu) → review+

Comment 7

2 years ago
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a84e0b5bc993
Handle lazy self-hosted functions in optimization tracking debug spew. r=shu

Comment 8

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/a84e0b5bc993
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox52: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
You need to log in before you can comment on or make changes to this bug.