Closed Bug 724579 Opened 12 years ago Closed 12 years ago

IonMonkey: Crash [@ js::ion::IonFrameIterator::checkInvalidation] or [@ js::ion::IonJSFrameLayout::calleeToken] or "Assertion failure: code->raw() == buffer,"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: dvander)

References

Details

(Keywords: assertion, crash, testcase)

Crash Data

Attachments

(4 files)

Attached file testcase
The attached testcase asserts js debug shell on IonMonkey changeset 43b55878da46 with -m, -a (yes, -a!), --ion and -n at Assertion failure: code->raw() == buffer. Without the -a flag, this crashes js opt shell at js::ion::IonFrameIterator::checkInvalidation
I don't seem to get the assert anymore with -a using changeset a1fc5b03be76, but the crash still occurs without -a.
The crash in debug without -a is at js::ion::IonJSFrameLayout::calleeToken.
Crash Signature: [@ js::ion::IonFrameIterator::checkInvalidation] → [@ js::ion::IonJSFrameLayout::calleeToken] [@ js::ion::IonFrameIterator::checkInvalidation]
Summary: IonMonkey: Crash [@ js::ion::IonFrameIterator::checkInvalidation] or "Assertion failure: code->raw() == buffer," → IonMonkey: Crash [@ js::ion::IonFrameIterator::checkInvalidation] or [@ js::ion::IonJSFrameLayout::calleeToken] or "Assertion failure: code->raw() == buffer,"
Attached patch first fixSplinter Review
Two separate bugs here. The first one is that the invalidation bit on IonCode objects was only getting set on gc invalidation, but not normal invalidation.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #594830 - Flags: review?
Attachment #594830 - Attachment description: :cdleary → first fix
Attachment #594830 - Flags: review? → review?(christopher.leary)
Attached patch second fixSplinter Review
The second bug is that we're invalidating inside ion::Bailout, which causes a lot of trouble since bailouts do not occur inside exit frames. Brian says we can just not run this if calling from Ion code.
Attachment #594845 - Flags: review?(bhackett1024)
Attachment #594845 - Flags: review?(bhackett1024) → review+
Attachment #594830 - Flags: review?(christopher.leary) → review+
No longer blocks: 630996
You need to log in before you can comment on or make changes to this bug.