1385310 - Assertion failure: uint32_t(parent->key_ >> 32) <= uint32_t(child->key_ >> 32) && uint32_t(child->key_) <= uint32_t(parent->key_), at js/src/vm/Xdr.cpp:267

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicolas B. Pierron [:nbp]]

Seen while testing JSBC eager mode on mochitest[1].  This assertion appears while encoding the bytecode for a page.

[1] https://treeherder.mozilla.org/logviewer.html#?job_id=118957112&repo=try&lineNumber=6048

Comment 1

[Intermittent Failures Robot]

1 failures in 1008 pushes (0.001 failures/push) were associated with this bug in the last 7 days.   

Repository breakdown:
* try: 1

Platform breakdown:
* linux64: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1385310&startday=2017-07-24&endday=2017-07-30&tree=all

Comment 2

[Nicolas B. Pierron [:nbp]]

I managed to reproduce this issue under rr, with:
  mach mochitest --setpref dom.script_loader.bytecode_cache.strategy=-1 dom/base/test/test_bug418986-1.html

Comment 3

[Nicolas B. Pierron [:nbp]]

This issue is caused by the XDR incremental encoding for the following content:

  var test = function () {
    // Returns generator object that iterates through values.
    let prefVals = (for (prefVal of [false, true]) prefVal);

    for (x of prefVals) ;
  }

The prefVals is being converted into a function which has a bad sourceStart_ location set to 0, instead of the beginning of the expression.  Which causes the previous assertion in the incremental encoder as we expect all functions to be stacked in terms of start/end positions.

Comment 4

[Nicolas B. Pierron [:nbp]]

Attachment: Minimal JS shell test case.

Comment 5

[Tooru Fujisawa [:arai]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=00d77cb651b328c6b375b630f9c204669d4d308c

Comment 6

[Tooru Fujisawa [:arai]]

Attachment: Set bufStart and toStringStart for generator expression functions.

Fixed bufStart and toStringStart of generator comprehension function to `begin`, that points "(" before "for".
Also, added FunctionBox::setStart with offset parameter, to pass not-current offset.

Comment 7

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8895541 [details] [diff] [review]
Set bufStart and toStringStart for generator expression functions.

Review of attachment 8895541 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks :)

::: js/src/jit-test/tests/xdr/bug1385310.js
@@ +6,5 @@
> +
> +var test = function (isContent) {
> +
> +    /*
> +  SimpleTest.waitForExplicitFinish();

nit: my bad, I forgot to save the removal of these /**/ comments before uploading the minimal test case.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e360f8351242
Set bufStart and toStringStart for generator expression functions. r=nbp

Comment 9

[Tooru Fujisawa [:arai]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e360f835124223f465b2d035582a1f725298faa9
Bug 1385310 - Set bufStart and toStringStart for generator expression functions. r=nbp

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/e360f8351242