2018081 - Assertion failure: kind != BailoutKind::Unknown, at /builds/worker/checkouts/gecko/js/src/jit/shared/Lowering-shared.cpp:280

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20260219-64b3c91301e8 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting http://outof.cards/.

Assertion failure: kind != BailoutKind::Unknown, at /builds/worker/checkouts/gecko/js/src/jit/shared/Lowering-shared.cpp:280

18|0|xul.dll|js::jit::LIRGeneratorShared::assignSnapshot(js::jit::LInstruction*, js::jit::BailoutKind)|git:github.com/mozilla-firefox/firefox:js/src/jit/shared/Lowering-shared.cpp:8ce9d585aca55919997d1a05506c69e309369167|280|0xae
18|1|xul.dll|js::jit::LIRGenerator::visitLoadUnboxedScalar(js::jit::MLoadUnboxedScalar*)|git:github.com/mozilla-firefox/firefox:js/src/jit/Lowering.cpp:8ce9d585aca55919997d1a05506c69e309369167|5120|0x2cf
18|2|xul.dll|js::jit::LIRGenerator::visitInstruction(js::jit::MInstruction*)|git:github.com/mozilla-firefox/firefox:js/src/jit/Lowering.cpp:8ce9d585aca55919997d1a05506c69e309369167|8446|0x3e
18|3|xul.dll|js::jit::LIRGenerator::visitBlock(js::jit::MBasicBlock*)|git:github.com/mozilla-firefox/firefox:js/src/jit/Lowering.cpp:8ce9d585aca55919997d1a05506c69e309369167|8519|0xde
18|4|xul.dll|js::jit::LIRGenerator::generate()|git:github.com/mozilla-firefox/firefox:js/src/jit/Lowering.cpp:8ce9d585aca55919997d1a05506c69e309369167|8593|0x83
18|5|xul.dll|js::jit::GenerateLIR(js::jit::MIRGenerator*)|git:github.com/mozilla-firefox/firefox:js/src/jit/Ion.cpp:8ce9d585aca55919997d1a05506c69e309369167|1611|0xec
18|6|xul.dll|js::jit::CompileBackEnd(js::jit::MIRGenerator*, js::jit::WarpSnapshot*)|git:github.com/mozilla-firefox/firefox:js/src/jit/Ion.cpp:8ce9d585aca55919997d1a05506c69e309369167|1699|0x164
18|7|xul.dll|js::jit::IonCompileTask::runHelperThreadTask(js::AutoLockHelperThreadState&)|git:github.com/mozilla-firefox/firefox:js/src/jit/IonCompileTask.cpp:8ce9d585aca55919997d1a05506c69e309369167|30|0x80
18|8|xul.dll|js::GlobalHelperThreadState::runTaskLocked(JS::HelperThreadTask*, js::AutoLockHelperThreadState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/HelperThreads.cpp:8ce9d585aca55919997d1a05506c69e309369167|667|0x110
18|9|xul.dll|JS::RunHelperThreadTask(JS::HelperThreadTask*)|git:github.com/mozilla-firefox/firefox:js/src/vm/HelperThreads.cpp:8ce9d585aca55919997d1a05506c69e309369167|612|0xb0
18|10|xul.dll|HelperThreadTaskHandler::Run()|git:github.com/mozilla-firefox/firefox:js/xpconnect/src/XPCJSContext.cpp:8ce9d585aca55919997d1a05506c69e309369167|1162|0xc
18|11|xul.dll|mozilla::TaskController::RunPoolThread(mozilla::PoolThread*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:8ce9d585aca55919997d1a05506c69e309369167|449|0x22a
18|12|nss3.dll|_PR_NativeRunThread(void*)|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/threads/combined/pruthr.c:8ce9d585aca55919997d1a05506c69e309369167|382|0x120
18|13|nss3.dll|pr_root(void*)|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/md/windows/w95thred.c:8ce9d585aca55919997d1a05506c69e309369167|129|0x10

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/hIXlGkctGhXnvlCTjv4Hbg/index.html

Comment 2

[André Bargull [:anba]]

Attachment: Bug 2018081: Set bailout kind in SubarrayReplacer::visitLoadUnboxedScalar. r=jandem!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/cb9cfc5e49df
https://hg.mozilla.org/integration/autoland/rev/cb0f6ae6e017
Set bailout kind in SubarrayReplacer::visitLoadUnboxedScalar. r=jandem

Comment 4

[Jan de Mooij [:jandem]]

Setting 'Regressed By' for tracking purposes and to silence the bot.

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/cb0f6ae6e017

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.