1545379 - Crash [@ vixl::Instruction::InstructionBits]

Status: RESOLVED DUPLICATE of bug 1546446

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 02b89c29412b (build with --enable-simulator=arm64, run with --fuzzing-safe --ion-offthread-compile=off --ion-warmup-threshold=0 --ion-limit-script-size=off):

See attachment.

Backtrace:

#0 vixl::Instruction::InstructionBits (this=0x40000255f) at js/src/jit/arm64/vixl/Instructions-vixl.h:179
#1 vixl::Instruction::Bits (this=0x40000255f, msb=28, lsb=27) at js/src/jit/arm64/vixl/Instructions-vixl.h:191
#2 vixl::Decoder::DecodeInstruction (this=0x7fd92742d100, instr=0x40000255f) at js/src/jit/arm64/vixl/Decoder-vixl.cpp:37
#3 0x000055dbf1d35ffc in vixl::Decoder::Decode (this=0x7fd92742d100, instr=0x40000255f) at js/src/jit/arm64/vixl/Decoder-vixl.h:158
#4 vixl::Simulator::ExecuteInstruction (this=0x7fd92743c800) at js/src/jit/arm64/vixl/MozSimulator-vixl.cpp:192
/snip

For detailed crash information, see attachment.

(Note that the testcase takes about 30 seconds to crash)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/7ee65d07d83f
user: Jan de Mooij
date: Wed Mar 27 12:18:59 2019 +0000
summary: Bug 1382650 part 3 - Clean up Ion eager compilation code. r=nbp

Jan, I'm totally unsure as to whether bug 1382650 is a likely regressor...

Comment 4

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #3)

Jan, I'm totally unsure as to whether bug 1382650 is a likely regressor...

It's unlikely but it changed --ion-eager behavior slightly. Does it reproduce before that with --ion-eager instead of --ion-warmup-threshold=0?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

You're right, it does, in fact, it goes way back to m-c rev 80a506f7caa7 by using --ion-eager instead of --ion-warmup-threshold=0 before that changeset.

https://hg.mozilla.org/mozilla-central/rev/80a506f7caa7

Setting needinfo? from :sstangl and :nbp then.

Comment 6

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 7

[Patricia Lawless]

Hey nbp, is this being worked on for 68? Thanks!

Comment 8

[Nicolas B. Pierron [:nbp]]

(In reply to Patricia Lawless from comment #7)

Hey nbp, is this being worked on for 68? Thanks!

This is blocked by Bug 1546446, which has a patch waitting for review.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nicolas, bug 1546446 has been fixed, and I'm seemingly unable to reproduce this anymore, what's next?

Comment 10

[Nicolas B. Pierron [:nbp]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #9)

Nicolas, bug 1546446 has been fixed, and I'm seemingly unable to reproduce this anymore, what's next?

Closing this bug.