1937176 - Assertion failure: rawIndex > 0 && index < RealmFuses::FuseIndex::LastFuseIndex, at vm/RealmFuses.cpp:75

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

gczeal(19);
for (let i = 0; i < 99; i++) {
  function g() {
    function f() {
      with ({}) {}
    }
    class C extends f {}
  }
  g();
  disblic(g);
}

(gdb) bt
#0  js::jit::ICStub::jitCode (this=this@entry=0x7ffff657e2d0) at /home/i32g7900a/trees/mozilla-central/js/src/jit/BaselineIC.h:199
#1  0x000055555784b437 in DisassembleBaselineICs (cx=0x7ffff6f39a00, argc=<optimized out>, vp=<optimized out>)
    at /home/i32g7900a/trees/mozilla-central/js/src/builtin/TestingFunctions.cpp:1937
#2  0x000010ef43cd7143 in ?? ()
#3  0x0000000000000089 in ?? ()
#4  0x00007fffffffc830 in ?? ()
#5  0x0000000000000000 in ?? ()
(gdb)

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8228bb0a8957
user:        Iain Ireland
date:        Thu Dec 05 18:20:38 2024 +0000
summary:     Bug 1791109: Add testing function to disassemble baseline ics r=mgaudet

Run with --fuzzing-safe --no-threads --fast-warmup, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 49130c85c5ed.

Setting s-s just in case. Iain, is bug 1791109 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Assertion stack for another testcase

function f() {
  for (let i = 0; i < 9; i++) {
    for (let [j] = [0]; j < 1; j++) {}
  }
}
f();
disblic(f);

shows Assertion failure: rawIndex > 0 && index < RealmFuses::FuseIndex::LastFuseIndex, at vm/RealmFuses.cpp:75, run with --fuzzing-safe --no-threads --fast-warmup.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1791109

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

Incorrectly written assert (by me) patch incoming.

Comment 6

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1937176 - Fix incorrect assertion bound r?iain

Comment 7

[Iain Ireland [:iain]]

There are actually two bugs here: the assertion Matt fixed (testcase in comment 1) and the original one involving gczeal. We'll make this bug about the former, and fix the other one in bug 1937430.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f3262fe1c37c
Fix incorrect assertion bound r=iain

Comment 9

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/f3262fe1c37c