1316565 - Assertion failure: hasBaselineScript(), at js/src/jsscript.h:1410

Status: RESOLVED DUPLICATE of bug 1289610

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 336759fad462 (build with --enable-debug --enable-more-deterministic --32, run with --fuzzing-safe --no-threads):

See attachment.

Backtrace:

0   js-dbg-32-dm-clang-darwin-336759fad462	0x006920b4 JSScript::setIonScript(JSRuntime*, js::jit::IonScript*) + 196 (jsscript.h:1410)
1   js-dbg-32-dm-clang-darwin-336759fad462	0x0022fb62 js::jit::CodeGenerator::link(JSContext*, js::CompilerConstraintList*) + 1634 (CodeGenerator.cpp:9628)
2   js-dbg-32-dm-clang-darwin-336759fad462	0x002e597b LinkCodeGen(JSContext*, js::jit::IonBuilder*, js::jit::CodeGenerator*) + 283 (Ion.cpp:524)
3   js-dbg-32-dm-clang-darwin-336759fad462	0x00275c62 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) + 4114 (Ion.cpp:2310)
4   js-dbg-32-dm-clang-darwin-336759fad462	0x00274826 js::jit::CanEnter(JSContext*, js::RunState&) + 406 (Ion.cpp:2582)
/snip

For detailed crash information, see attachment.

Setting s-s because there is a call to gcslice near the bottom of the testcase. This was a pain to reduce because the value had to be tweaked downwards as the testcase was reduced.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Note that this is reliably reproducible on a 32-bit deterministic shell on Mac.

Bisection is in progress...

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/f7823287275f
user:        André Bargull
date:        Thu Oct 06 22:37:20 2016 -0700
summary:     Bug 837961 - Part 2: Implement timeZone support for Intl.DateTimeFormat. r=Waldo

Not sure if this is correct. Andre, is bug 837961 a likely regressor? Also oomTest is present, so cc'ing :jonco

Comment 6

[André Bargull [:anba]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> Not sure if this is correct. Andre, is bug 837961 a likely regressor? Also
> oomTest is present, so cc'ing :jonco

I wasn't able to reproduce the assertion failure on Linux, it only printed "ReportOutOfMemory called" a few dozen times. 

My current guess is that bug 837961 showed up in the bisection because it increased GC pressure. Sorry I couldn't be of any help here.

Comment 7

[Jan de Mooij [:jandem]]

This is probably the same as bug 1289610. I'll take a look this week.

Comment 8

[Jan de Mooij [:jandem]]

Yes dupe of bug 1289610.