1535901 - Crash [@ js::gc::Cell::storeBuffer] or Assertion failure: (asBits_ >> 47) <= JSVAL_TAG_OBJECT, at dist/include/js/Value.h:622

Status: RESOLVED DUPLICATE of bug 1534810

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 2a96d8f9339f (build with --enable-more-deterministic --enable-simulator=arm64, run with --fuzzing-safe --no-threads --ion-eager --ion-regalloc=testbed):

function f() {
    return (8 * true) | 0
}
y = [0];
(function() {
    var x = [];
    for (j = 0; j < 9; ++j) {
        for (k = 0; k < 1; ++k) {
            x.push(f(y[k]));
        }
    }
    n();
})()

Backtrace:

#0 js::gc::Cell::storeBuffer (this=<optimized out>) at js/src/gc/Cell.h:271
#1 js::NativeObject::elementsRangeWriteBarrierPost (this=<optimized out>, start=<optimized out>, count=<optimized out>) at js/src/vm/NativeObject-inl.h:119
#2 js::NativeObject::copyDenseElements (this=0x1d69e7c005a8, dstStart=<optimized out>, src=<optimized out>, count=<optimized out>) at js/src/vm/NativeObject-inl.h:151
#3 0x00005646b7cc2494 in js::NativeObject::setOrExtendDenseElements (this=0x1d69e7c005a8, cx=0x7fd4dae16000, start=6, vp=0x7fd4dad7fd80, count=1, updateTypes=js::ShouldUpdateTypes::DontUpdate) at js/src/vm/NativeObject-inl.h:436
#4 0x00005646b8226ed4 in js::jit::ArrayPushDense (cx=0x7fd4dae16000, arr=..., v=..., length=0x7fd4dad7fd58) at js/src/jit/VMFunctions.cpp:454
#5 0x00005646b82becee in vixl::Simulator::VisitCallRedirection (this=0x7fd4dae37800, instr=0x7fd4dae286e8) at js/src/jit/arm64/vixl/MozSimulator-vixl.cpp:583
/snip

For detailed crash information, see attachment.

This asserts js debug shell at Assertion failure: (asBits_ >> 47) <= JSVAL_TAG_OBJECT, at dist/include/js/Value.h:622 but seems to differ from bug 1532405 that it does not require GVN to be off.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/afb2e1e1665f
user: Sean Stangl
date: Thu Mar 07 03:57:23 2019 +0000
summary: Bug 1528869 - Enable IonMonkey in the ARM64 shell, but keep it disabled in the browser. r=nbp

Likely related to IonMonkey on ARM64, so setting needinfo? from :sstangl and :nbp.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Also locking s-s because bug 1532405 with the same assertion is s-s.

Comment 4

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 5

[Nicolas B. Pierron [:nbp]]

After testing, I confirm this was a duplicate of Bug 1534810.