1765249 - Assertion failure: this->is<MIRType>(), at js/src/jit/MIR.h:789

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[lukas.bernhard]

Steps to reproduce:

The attached samples triggers the following assertion in SM:
Assertion failure: this->is<MIRType>(), at js/src/jit/MIR.h:789
Bisecting the issue identifies git commit 0ce05dd4eaabfcb8274e0bf41cdfb0201104147b related to bug 1131996.

command line:

obj-x86_64-pc-linux-gnu/dist/bin/js --fast-warmup --no-threads --cpu-count=1 --ion-offthread-compile=off --fuzzing-safe sample.js

sample.js

function main() {
    let v0 = 0;
    for (let v4 = 1; v4 < 30; v4++) {
        with ({}) {}
        function v8() {
            for (let v12 = v0; v12 < 5; v12++) {
                arguments[v12];
                v0 = undefined;
                for (const v19 of "aaa") { } 

                function v20() {
                    let v23 = arguments[0];
                    v23.__proto__ = {}; 
                    for (let v27 = 0; v27 < 100; v27 = v27 + 0) {
                        v27 *= undefined;
                    }   
                }   
                const v29 = v20(arguments);
            }   
        }   
        v8();
    }   
}
main();

Out of curiosity, how is the with({}) {} changing the behavior of SM as this seems a prerequisite to trigger the issue (or at least makes it more likely)?

Comment 1

[André Bargull [:anba]]

Out of curiosity, how is the with({}) {} changing the behavior of SM as this seems a prerequisite to trigger the issue (or at least makes it more likely)?

with disables Warp compilation, which in turn prevents inlining v8 into main. When main is too large to allow inlining, the assertion can also be triggered. main can be made too large by adding 36 for (let i = 0; i < 1; ++i); empty loops at the end. The bytecode size then exceeds 2000, which is above the limit for main-thread compilation.

Minimised test case:

function main() {
  // Disable Warp compilation, so we don't inline |f|.
  with ({}) {}

  let begin = 0;
  for (let i = 1; i < 30; i++) {
    f(begin);
    begin = undefined;
  }
}
main();

function f(begin) {
  for (let i = begin; i < 5; i++) {
    arguments[i];

    for (const c of "aaa") {}

    arguments.__proto__ = {};
  }
}

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1765249: Remove incorrect assertion when replacing prototype guard. r=iain!

This was just an extra assertion to make sure the previous pass to compute
supported arguments operations doesn't let through any unexpected operations
which may have modified the prototype. We've already skipped this assertion for
MCreateInlinedArgumentsObject or when no template object is available.

Comment 3

[Nicolas B. Pierron [:nbp] {pto}]

S2 -> S4, based on the title of the submitted patch.

Comment 4

[Andrew McCreight [:mccr8]]

Bad assertion, so I'm removing the sec flag.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/dea9b0b1371c
Remove incorrect assertion when replacing prototype guard. r=iain

Comment 6

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/dea9b0b1371c