1851976 - Assertion failure: Infallible unbox type mismatch, at jit/VMFunctions.cpp:2868

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20230907-f829a45e2207 (debug build, run with --fuzzing-safe --ion-offthread-compile=off --ion-warmup-threshold=0 --baseline-eager --ion-gvn=off test.js):

function a() {}
for (;;) a(...[])

Backtrace:

received signal SIGTRAP, Trace/breakpoint trap.
#0  0x0000344cf4d0e83a in ?? ()
#1  0x0000375ef853f038 in ?? ()
#2  0x00007fae1b1a4700 in ?? ()
#3  0x0000000000000000 in ?? ()
rax	0x1	1
rbx	0x7fae1b1a4720	140385755744032
rcx	0xfff9800000000000	-1829587348619264
rdx	0x7fae1c32ee20	140385774136864
rsi	0x375ef853f038	60881032704056
rdi	0x1b	27
rbp	0x7ffe65380190	140730596589968
rsp	0x7ffe65380160	140730596589920
r8	0x0	0
r9	0x7ffe6537fc98	140730596588696
r10	0x7ffe653e6080	140730597007488
r11	0x7fae1f4bd340	140385826100032
r12	0x0	0
r13	0x0	0
r14	0x0	0
r15	0x0	0
rip	0x344cf4d0e83a	57505129490490
=> 0x344cf4d0e83a:	movabs $0xfffe000000000000,%rdx
   0x344cf4d0e844:	xor    %rcx,%rdx

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1850305

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230907092106-c8b40099127c.
Unable to bisect testcase (Unable to launch the start build!):

Start: 2df511a16e4194617632cce3f261312c8e068620 (20220908045224)
End: f829a45e22076f02abeee8ca0f757a842da4f4de (20230907040951)
BuildFlags: BuildFlags(asan=None, tsan=None, debug=True, fuzzing=True, coverage=None, valgrind=None, no_opt=None, fuzzilli=None, nyx=None)

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Bug 1851976 - Mark infallible unbox non-movable. r?iain!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8de24ac4d247
Mark infallible unbox non-movable. r=iain

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/8de24ac4d247

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230908211202-eb062b89c03a.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.