1328132 - Assertion failure: current->getSlot(idx) == def, at js/src/jit/IonBuilder.cpp:9814

Status: RESOLVED DUPLICATE of bug 1328252

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 31ffcb82ced8 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off):

function testCALLELEM() {
    function f() {}
    function g() {}
    var x = [f, f, f, f, g];
    for (var j = 0; j < 10000; j++)
      y = x['#'	| this && x && this]();
}
testCALLELEM();



Backtrace:

 received signal SIGSEGV, Segmentation fault.
js::jit::IonBuilder::maybeUnboxForPropertyAccess (this=this@entry=0x7ffff032c2b8, def=def@entry=0x7ffff69b3ad0) at js/src/jit/IonBuilder.cpp:9814
#0  js::jit::IonBuilder::maybeUnboxForPropertyAccess (this=this@entry=0x7ffff032c2b8, def=def@entry=0x7ffff69b3ad0) at js/src/jit/IonBuilder.cpp:9814
#1  0x00000000006411a3 in js::jit::IonBuilder::maybeUnboxForPropertyAccess (def=0x7ffff69b3ad0, this=0x7ffff032c2b8) at js/src/jit/IonBuilder.cpp:7345
#2  js::jit::IonBuilder::jsop_getelem (this=this@entry=0x7ffff032c2b8) at js/src/jit/IonBuilder.cpp:7343
#3  0x000000000064f025 in js::jit::IonBuilder::inspectOpcode (this=this@entry=0x7ffff032c2b8, op=op@entry=JSOP_CALLELEM) at js/src/jit/IonBuilder.cpp:2101
#4  0x00000000006504f8 in js::jit::IonBuilder::visitBlock (this=this@entry=0x7ffff032c2b8, cfgblock=cfgblock@entry=0x7ffff0334370, mblock=<optimized out>) at js/src/jit/IonBuilder.cpp:1512
#5  0x000000000064623b in js::jit::IonBuilder::traverseBytecode (this=this@entry=0x7ffff032c2b8) at js/src/jit/IonBuilder.cpp:1433
#6  0x0000000000647149 in js::jit::IonBuilder::build (this=this@entry=0x7ffff032c2b8) at js/src/jit/IonBuilder.cpp:842
#7  0x000000000065c997 in js::jit::IonCompile (cx=cx@entry=0x7ffff695f000, script=<optimized out>, baselineFrame=baselineFrame@entry=0x7fffffffc668, osrPc=<optimized out>, recompile=<optimized out>, optimizationLevel=optimizationLevel@entry=js::jit::OptimizationLevel::Normal) at js/src/jit/Ion.cpp:2280
#8  0x000000000065d4d2 in js::jit::Compile (cx=cx@entry=0x7ffff695f000, script=script@entry=..., osrFrame=osrFrame@entry=0x7fffffffc668, osrPc=osrPc@entry=0x7ffff69a1fe3 "\343\201V", forceRecompile=<optimized out>) at js/src/jit/Ion.cpp:2533
#9  0x000000000065df50 in BaselineCanEnterAtBranch (pc=0x7ffff69a1fe3 "\343\201V", osrFrame=0x7fffffffc668, script=..., cx=<optimized out>) at js/src/jit/Ion.cpp:2724
#10 js::jit::IonCompileScriptForBaseline (cx=0x7ffff695f000, frame=frame@entry=0x7fffffffc668, pc=pc@entry=0x7ffff69a1fe3 "\343\201V") at js/src/jit/Ion.cpp:2782
#11 0x0000000000e99262 in js::jit::DoWarmUpCounterFallbackOSR (cx=0x7ffff695f000, frame=0x7fffffffc668, stub=0x7ffff03353b8, infoPtr=0x7fffffffc618) at js/src/jit/BaselineIC.cpp:144
#12 0x00007ffff7e43344 in ?? ()
[...]
#22 0x0000000000000000 in ?? ()
rax	0x2052520	33891616
rbx	0x7ffff69b3ad0	140737330756304
rcx	0x11e5220	18764320
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffbe60	140737488338528
rsp	0x7fffffffbe40	140737488338496
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff032c2b8	140737223246520
r13	0x7ffff69b3cd8	140737330756824
r14	0x9	9
r15	0x7ffff032c2b8	140737223246520
rip	0x5fcfb9 <js::jit::IonBuilder::maybeUnboxForPropertyAccess(js::jit::MDefinition*)+249>
=> 0x5fcfb9 <js::jit::IonBuilder::maybeUnboxForPropertyAccess(js::jit::MDefinition*)+249>:	movl   $0x0,0x0
   0x5fcfc4 <js::jit::IonBuilder::maybeUnboxForPropertyAccess(js::jit::MDefinition*)+260>:	ud2

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/be2f6cb7251c
user:        Hannes Verschore
date:        Wed Apr 20 06:40:16 2016 -0400
summary:     Bug 1241088: SharedStubs - part 2: port NewArray and NewObject shared stubs to work in ion, r=efaust

Hannes, is bug 1241088 a likely regressor?

Comment 2

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision a14094edbad7).

Comment 3

[Fuzzing Team]

JSBugMon: Fix Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20160420031344" and the hash "beca0a8904718c01dfe57a758ce2ceccc028dc2b".
The "bad" changeset has the timestamp "20160420034139" and the hash "7c1f8d3d4f69add3995d27d4c70c92d286aa54b9".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=beca0a8904718c01dfe57a758ce2ceccc028dc2b&tochange=7c1f8d3d4f69add3995d27d4c70c92d286aa54b9

Comment 4

[Hannes Verschore [:h4writer]]

Attachment: Patch

This fixes the testcase. IonBuilder was getting confused since the output wasn't an object anymore and we were doing the optimization added in bug 1187511.

That code is assuming to have some JSOP_DUP, which in this testcase is not the case. We might want to try to improve the guard here. Though not sure how? Should we keep lastPc, nexto pc and use that?

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Get spewer to work on not finished graphs.

During debugging I spewed the graph midpoint. But that gave me some errors, since lastIns is not defined. I fixed those.

Comment 7

[Jan de Mooij [:jandem]]

Comment on attachment 8833961 [details] [diff] [review]
Patch

Review of attachment 8833961 [details] [diff] [review]:
-----------------------------------------------------------------

Is this the right patch? MIRType_Object was replaced with MIRType::Object a long time ago.

Comment 8

[Hannes Verschore [:h4writer]]

I probably made it on the original failing revision. Should be obvious to rebase to current revision. It should fix the issue in the current state too, but I'll retest to be sure.

Comment 9

[Hannes Verschore [:h4writer]]

Attachment: Patch

As proposed

Comment 10

[Hannes Verschore [:h4writer]]

Comment on attachment 8834363 [details] [diff] [review]
Patch

Mixing up two bugs. Sorry.