1669913 - Assertion failure: hasJitScript(), at vm/JSScript.h:1818 with rateMyCacheIR

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20201007-7e9a6ef4ba02 (debug build, run with --fuzzing-safe --cpu-count=2 --ion-offthread-compile=off):

var g1 = newGlobal();
g1.rateMyCacheIR("");

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000555557a26dfe in js::jit::CacheIRHealth::rateMyCacheIR(JSContext*, JS::Handle<JSScript*>) ()
#1  0x0000555556ba514e in RateMyCacheIR(JSContext*, unsigned int, JS::Value*) ()
#2  0x0000555556d0c1d2 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
[...]
#13 0x0000555556b86ed4 in Shell(JSContext*, js::cli::OptionParser*, char**) ()
#14 0x0000555556b7f58d in main ()
rax	0x5555559443f1	93824996361201
rbx	0x7fffffffb820	140737488336928
rcx	0x555558543310	93825042494224
rdx	0x0	0
rsi	0x7ffff7105770	140737338431344
rdi	0x7ffff7104540	140737338426688
rbp	0x7fffffffb7f0	140737488336880
rsp	0x7fffffffb7a0	140737488336800
r8	0x7ffff7105770	140737338431344
r9	0x7ffff7f99e00	140737353719296
r10	0x58	88
r11	0x7ffff6dac7a0	140737334921120
r12	0x3	3
r13	0x7fffffffb830	140737488336944
r14	0x7ffff5a710a8	140737314754728
r15	0xaaaa00a800000001	-6149101619666485247
rip	0x555557a26dfe <js::jit::CacheIRHealth::rateMyCacheIR(JSContext*, JS::Handle<JSScript*>)+766>
=> 0x555557a26dfe <_ZN2js3jit13CacheIRHealth13rateMyCacheIREP9JSContextN2JS6HandleIP8JSScriptEE+766>:	movl   $0x71a,0x0
   0x555557a26e09 <_ZN2js3jit13CacheIRHealth13rateMyCacheIREP9JSContextN2JS6HandleIP8JSScriptEE+777>:	callq  0x555556c0e3e2 <abort>

Probably shell-only.

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Nicolas B. Pierron [:nbp]]

Caroline, can you have a look at this issue?

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201008094950-e88890094825.
The bug appears to have been introduced in the following build range:

Start: a2631cd8a7f4784e7defc5762901ba483150f03f (20201006002718)
End: 543509e7d886b5aae1de4e5b092a9fd8c4f29cf1 (20201006002748)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a2631cd8a7f4784e7defc5762901ba483150f03f&tochange=543509e7d886b5aae1de4e5b092a9fd8c4f29cf1

Comment 4

[Caroline Cullen [:caroline]]

Yes, I was able to reproduce. It is failing on the check for a JitScript, this is because I should be using maybeJitScript().

Comment 5

[Caroline Cullen [:caroline]]

Attachment: Bug 1669913 - Use maybeJitScript() to check for a JitScript to avoid failure in cases where a JitScript is not present. r?iain

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fc3e86aa0da0
Use maybeJitScript() to check for a JitScript to avoid failure in cases where a JitScript is not present. r=iain

Comment 7

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/fc3e86aa0da0

Comment 8

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20201009153554-1581160e62e6.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.