1318492 - Crash [@ js::jit::AssertBasicGraphCoherency]

Status: RESOLVED DUPLICATE of bug 1314172

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 05e5b12f41df (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

x = new Uint8ClampedArray;
y = new Uint8Array;
y.subarray();
z = x.subarray();
oomTest(function() {
    z.subarray();
})


Backtrace:

0   js-dbg-64-dm-clang-darwin-05e5b12f41df	0x0000000105a51d51 js::jit::AssertBasicGraphCoherency(js::jit::MIRGraph&) + 2161 (IonAnalysis.cpp:2625)
1   js-dbg-64-dm-clang-darwin-05e5b12f41df	0x0000000105a4e186 js::jit::OptimizeMIR(js::jit::MIRGenerator*) + 230 (Ion.cpp:1513)
2   js-dbg-64-dm-clang-darwin-05e5b12f41df	0x0000000105a5b81a js::jit::CompileBackEnd(js::jit::MIRGenerator*) + 74 (Ion.cpp:2023)
3   js-dbg-64-dm-clang-darwin-05e5b12f41df	0x0000000105a5d863 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) + 3779 (Ion.cpp:2304)
4   js-dbg-64-dm-clang-darwin-05e5b12f41df	0x0000000105a5c5f6 js::jit::CanEnter(JSContext*, js::RunState&) + 438 (Ion.cpp:2584)
/snip

For detailed crash information, see attachment.

Even though oomTest is involved, still locking s-s to be safe because TypedArrays are involved and MIR is on the stack.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/47e4fb57325d
user:        Nicolas B. Pierron
date:        Fri Oct 28 12:45:31 2016 +0000
summary:     Bug 1303399 part 2 - IonMonkey: Fallback when we fail to inline an uninlinable function. r=h4writer

Nicolas, is bug 1303399 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: OOM_VERBOSE=1 stack from m-c rev 05e5b12f41df

Comment 4

[Nicolas B. Pierron [:nbp]]

Bug 1314172 is adding a flag to disable Bug 1303399 feature.

Once this is done and backtracked we should fix all the OOM reporting issues from IonBuilder (Bug 1286505) and hopefully fix this issue at the same time.

Comment 5

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision f8f4eaac1701).