1592524 - Assertion failure: mir->resumePoint(), at js/src/jit/CodeGenerator.cpp:296

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 53ebedebdb63 (build with --enable-debug --disable-optimize, run with --fuzzing-safe --ion-eager):

See attachment.

Backtrace:

#0  0x0000555558353f00 in js::jit::CodeGenerator::callVMInternal (this=0x7fffef3d8000, id=js::jit::VMFunctionId::ToStringSlow, ins=0x7fffebf64ab8, dynStack=0x0) at js/src/jit/CodeGenerator.cpp:296
#1  0x00005555583f8fb6 in js::jit::CodeGenerator::callVM<JSString* (*)(JSContext*, JS::Handle<JS::Value>), &js::ToStringSlow<(js::AllowGC)1> > (this=0x7fffef3d8000, ins=0x7fffebf64ab8, dynStack=0x0) at js/src/jit/CodeGenerator.cpp:346
#2  0x00005555583f8e63 in js::jit::CodeGenerator::visitOutOfLineCallVM<JSString* (*)(JSContext*, JS::Handle<JS::Value>), &js::ToStringSlow<(js::AllowGC)1>, js::jit::ArgSeq<js::jit::ValueOperand&>, js::jit::StoreRegisterTo> (this=0x7fffef3d8000, ool=0x7fffea55c7a8) at js/src/jit/CodeGenerator.cpp:525
#3  0x00005555583f8ddd in js::jit::OutOfLineCallVM<JSString* (*)(JSContext*, JS::Handle<JS::Value>), &js::ToStringSlow<(js::AllowGC)1>, js::jit::ArgSeq<js::jit::ValueOperand&>, js::jit::StoreRegisterTo>::accept (this=0x7fffea55c7a8, codegen=0x7fffef3d8000) at js/src/jit/CodeGenerator.cpp:490
#4  0x00005555583e2189 in js::jit::OutOfLineCodeBase<js::jit::CodeGenerator>::generate (this=0x7fffea55c7a8, codegen=0x7fffef3d8000) at js/src/jit/shared/CodeGenerator-shared.h:529
#5  0x0000555558211737 in js::jit::CodeGeneratorShared::generateOutOfLineCode (this=0x7fffef3d8000) at js/src/jit/shared/CodeGenerator-shared.cpp:191
#6  0x00005555582723b9 in js::jit::CodeGeneratorX86Shared::generateOutOfLineCode (this=0x7fffef3d8000) at js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp:535
/snip

For detailed crash information, see attachment.

Setting s-s as a start because MIR seems to be involved. The testcase seems to be increasingly intermittent as more reduction happens.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/45d661faa404
user: Jan de Mooij
date: Mon Oct 28 13:20:25 2019 +0000
summary: Bug 1590120 - Avoid repeated bailouts when MToString is used for jsop_tostring or the ToString intrinsic. r=anba

Jan, is bug 1590120 a likely regressor?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Pernosco link:

https://pernos.co/debug/ymvfPhSPzx0bfUxMtKyf0w/index.html

(Hopefully this time, it will be super useful again for such an intermittent bug!)

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #4)

https://pernos.co/debug/ymvfPhSPzx0bfUxMtKyf0w/index.html

(Hopefully this time, it will be super useful again for such an intermittent bug!)

I knew what the bug was from the assertion failure, but it was still useful to confirm :)

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Bug 1592524 - Use a bool class field instead of MToString::conversionMightHaveSideEffects(). r?anba!

The input operand could change in some cases, resulting in inconsistent return
values from isEffectful and getAliasSet.

Comment 7

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/autoland/rev/861a114eb85f59461b094193b34e95e61026694c

Comment 8

[Andrew McCreight [:mccr8]]

I'll mark this sec-high, just as a general JIT issue.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/861a114eb85f