1356424 - Assertion failure: numFailures_ > 0 (numFailures_ should not overflow), at js/src/jit/ICState.h:113

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 3243c8fc3ce7 (build with --enable-debug, run with --fuzzing-safe --no-threads --ion-eager --wasm-always-baseline):

x = [];
Object.defineProperty(x, 0, {
    set: function () {
        try {
            x.sort(function () {});
        } catch (e) {}
    }
}).unshift(0);

Backtrace:

#0  0x00000000006182bc in js::jit::ICState::trackNotAttached (this=<optimized out>) at js/src/jit/ICState.h:113
#1  0x00000000005f7595 in js::jit::DoSetElemFallback (cx=<optimized out>, frame=<optimized out>, stub_=<optimized out>, stack=0x7ffc388594d0, objv=..., index=..., rhs=...) at js/src/jit/BaselineIC.cpp:1032
#2  0x000025761cd67f11 in ?? ()
#3  0x00007ffc388594c8 in ?? ()
#4  0x00007ffc38859480 in ?? ()
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Actually --wasm-always-baseline is not needed.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

I can't reproduce this on Mac, but I'm pretty sure this is the same problem as bug 1350171 - I just forgot to update DoSetElemFallback in that bug :(

Gary, can you confirm this patch fixes it?

Comment 4

[Hannes Verschore [:h4writer]]

Comment on attachment 8859566 [details] [diff] [review]
Patch

Review of attachment 8859566 [details] [diff] [review]:
-----------------------------------------------------------------

I remember looking at all canAttachStub calls to make sure this check was there.
I must have overlooked, sorry.
Thanks!

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 8859566 [details] [diff] [review]
Patch

Yes, this fixes the bug. Thanks!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/77edd84ad552
Fix DoSetElemFallback to try to transition before attaching an add-slot stub. r=h4writer

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/77edd84ad552