1593971 - Assertion failure: input->type() == MIRType::Double, at js/src/jit/Lowering.cpp:2893

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 4d585c7edc76 (build with --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off):

var ua = new Uint32Array(0x10);
ua.__proto__ = new Array(0xffffffff);
ua.fill(0x41, 1, 0x41414141 + 0x10);

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  js::jit::LIRGenerator::visitTypedArrayIndexToInt32 (this=0x7fffffffb3c0, ins=0x7ffff4ddda10) at js/src/jit/Lowering.cpp:2893
#1  0x0000555556546c72 in js::jit::LIRGenerator::visitInstruction (this=this@entry=0x7fffffffb3c0, ins=ins@entry=0x7ffff4ddda10) at js/src/jit/Lowering.cpp:4798
#2  0x0000555556546fdf in js::jit::LIRGenerator::visitInstruction (ins=0x7ffff4ddda10, this=0x7fffffffb3c0) at js/src/jit/Lowering.cpp:4795
#3  js::jit::LIRGenerator::visitBlock (this=this@entry=0x7fffffffb3c0, block=block@entry=0x7ffff4ddca50) at js/src/jit/Lowering.cpp:4885
#4  0x000055555654749b in js::jit::LIRGenerator::generate (this=this@entry=0x7fffffffb3c0) at js/src/jit/Lowering.cpp:4959
#5  0x000055555643b4b5 in js::jit::GenerateLIR (mir=mir@entry=0x7ffff4dc1390) at js/src/jit/Ion.cpp:1530
#6  0x000055555648e6a9 in js::jit::CompileBackEnd (mir=mir@entry=0x7ffff4dc1390) at js/src/jit/Ion.cpp:1632
#7  0x000055555648f4a8 in js::jit::IonCompile (cx=<optimized out>, cx@entry=0x7ffff5f27000, script=<optimized out>, baselineFrame=baselineFrame@entry=0x7fffffffc848, baselineFrameSize=baselineFrameSize@entry=152, osrPc=osrPc@entry=0x7ffff5f0e1a8 "\343%", recompile=<optimized out>, optimizationLevel=js::jit::OptimizationLevel::Normal) at js/src/jit/Ion.cpp:1918
#8  0x000055555648fe46 in js::jit::Compile (cx=cx@entry=0x7ffff5f27000, script=script@entry=..., osrFrame=osrFrame@entry=0x7fffffffc848, osrFrameSize=osrFrameSize@entry=152, osrPc=osrPc@entry=0x7ffff5f0e1a8 "\343%", forceRecompile=<optimized out>) at js/src/jit/Ion.cpp:2134
#9  0x00005555564908bc in BaselineCanEnterAtBranch (pc=0x7ffff5f0e1a8 "\343%", osrFrameSize=152, osrFrame=0x7fffffffc848, script=..., cx=0x7ffff5f27000) at js/src/jit/Ion.cpp:2330
#10 IonCompileScriptForBaseline (cx=<optimized out>, frame=frame@entry=0x7fffffffc848, frameSize=frameSize@entry=152, pc=pc@entry=0x7ffff5f0e1a8 "\343%") at js/src/jit/Ion.cpp:2385
#11 0x0000555556490cf7 in js::jit::IonCompileScriptForBaselineOSR (cx=<optimized out>, frame=0x7fffffffc848, frameSize=152, pc=0x7ffff5f0e1a8 "\343%", infoPtr=0x7fffffffc7c0) at js/src/jit/Ion.cpp:2514
#12 0x00002afa74e29be7 in ?? ()
#13 0x00007fffffffc888 in ?? ()
#14 0x00007fffffffc7c0 in ?? ()
#15 0x0000000000000000 in ?? ()
rax	0x5555580adfa0	93825037688736
rbx	0x7fffffffb3c0	140737488335808
rcx	0x555556f687f0	93825019578352
rdx	0x0	0
rsi	0x7ffff6eeb770	140737336227696
rdi	0x7ffff6eea540	140737336223040
rbp	0x7fffffffb260	140737488335456
rsp	0x7fffffffb240	140737488335424
r8	0x7ffff6eeb770	140737336227696
r9	0x7ffff7fe6cc0	140737354034368
r10	0x58	88
r11	0x7ffff6b927a0	140737332717472
r12	0x7ffff4ddda10	140737301568016
r13	0x7ffff4ddda10	140737301568016
r14	0x7ffff4cc65f0	140737300424176
r15	0x7ffff4ddda60	140737301568096
rip	0x555556538f59 <js::jit::LIRGenerator::visitTypedArrayIndexToInt32(js::jit::MTypedArrayIndexToInt32*)+185>
=> 0x555556538f59 <js::jit::LIRGenerator::visitTypedArrayIndexToInt32(js::jit::MTypedArrayIndexToInt32*)+185>:	movl   $0x0,0x0
   0x555556538f64 <js::jit::LIRGenerator::visitTypedArrayIndexToInt32(js::jit::MTypedArrayIndexToInt32*)+196>:	ud2

Marking s-s because this assertion can indicate a type confusion in MIR.

Comment 1

[Andrew McCreight [:mccr8]]

Isn't 0x41 one of our poison patterns? It would be funny if that's causing some kind of false positive somewhere...

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/371d2efe156c
user: André Bargull
date: Tue Oct 29 09:34:57 2019 +0000
summary: Bug 1129202 - Part 8: Handle TypedArray non-int32 indices in SetPropIRGenerator. r=jandem

Andre, is bug 1129202 a likely regressor?

Comment 3

[André Bargull [:anba]]

Attachment: Bug 1593971: Add type policy to MTypedArrayIndexToInt32. r=jandem!

MTypedArrayIndexToInt32's input can be replaced with MPhi nodes after
construction. Use a type policy to ensure these MPhi node have the expected
type (either Int32 or Double).

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/c3a0f52402f856f9ef747ef6aca49d7123431f0d

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/c3a0f52402f8