1875487 - Assertion failure: cx_->hadResourceExhaustion(), at jit/WarpOracle.cpp:206

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20240117-f593f07c9772 (debug build, run with --fuzzing-safe --ion-offthread-compile=off):

uceFault = function(j29) {
    if (j29) return arguments;
}
function f85(j29) {
    i96 = Math.pow(2, j29);
    obj = (uceFault(j29) || uceFault);
}
max = 150;
for (j29 = 0; max; ++j29)
    f85(j29);

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000555558069faf in js::jit::WarpOracle::createSnapshot() ()
#1  0x0000555557fea6dd in js::jit::CreateWarpSnapshot(JSContext*, js::jit::MIRGenerator*, JS::Handle<JSScript*>) ()
#2  0x0000555557fe365c in js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) ()
#3  0x0000555557fe4533 in IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) ()
#4  0x00000ed4a2160fc6 in ?? ()
[...]
#15 0x0000000000000000 in ?? ()
rax	0x55555589ca6a	93824995674730
rbx	0x7fffffffc9a0	140737488341408
rcx	0x555558967878	93825046837368
rdx	0x0	0
rsi	0x7ffff7105770	140737338431344
rdi	0x7ffff7104540	140737338426688
rbp	0x7fffffffc980	140737488341376
rsp	0x7fffffffc8e0	140737488341216
r8	0x7ffff7105770	140737338431344
r9	0x7ffff7f92840	140737353689152
r10	0x2	2
r11	0x0	0
r12	0x7ffff3d19580	140737283986816
r13	0x0	0
r14	0x7ffff2b5a908	140737265379592
r15	0x65fa6dac	1710910892
rip	0x555558069faf <js::jit::WarpOracle::createSnapshot()+1823>
=> 0x555558069faf <_ZN2js3jit10WarpOracle14createSnapshotEv+1823>:	movl   $0xce,0x0
   0x555558069fba <_ZN2js3jit10WarpOracle14createSnapshotEv+1834>:	callq  0x555556ebf980 <abort>

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240119093321-b6393478fdf6.
The bug appears to have been introduced in the following build range:

Start: fdbf9ce9e9c3b39ed51622e0b013261837013e7f (20231103141653)
End: c1bbed9e33815cc111047e95375c6446ad566b5b (20231103153002)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=fdbf9ce9e9c3b39ed51622e0b013261837013e7f&tochange=c1bbed9e33815cc111047e95375c6446ad566b5b

Comment 4

[André Bargull [:anba]]

Attachment: Bug 1875487: Skip unbox to floating point types when propagating unbox type information. r=jandem!

Unbox to floating point types instructions support both boxed floating point
types and boxed int32 values. This means we can't propagate unbox-to-double when
the input can be a boxed int32 value, because other uses of the boxed value may
expect only int32 values.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1d9bf66a4a9c
Skip unbox to floating point types when propagating unbox type information. r=jandem

Comment 6

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/1d9bf66a4a9c

Comment 7

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20240123053648-7800a7cccda7.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1861983

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:anba, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox123 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[André Bargull [:anba]]

Comment on attachment 9375742 [details]
Bug 1875487: Skip unbox to floating point types when propagating unbox type information. r=jandem!

Beta/Release Uplift Approval Request

• User impact if declined: Repeated bailouts from Ion to Baseline, resulting in degraded performance.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Not risky, because it only disables a JIT optimisation for a specific input type.
• String changes made/needed:
• Is Android affected?: Yes

Comment 11

[Pascal Chevrel (relman team) -> :pascalc]

Comment on attachment 9375742 [details]
Bug 1875487: Skip unbox to floating point types when propagating unbox type information. r=jandem!

Approved for 123 beta 3, thanks.

Comment 12

[Pascal Chevrel (relman team) -> :pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/94d72a06d9b0