Closed
Bug 737737
Opened 12 years ago
Closed 12 years ago
IonMonkey: Crash [@ js::ion::LinearScanAllocator::populateSafepoints] or [@ js::ion::LIRGenerator::visitToInt32] or "Assertion failure: b.rval == MIRType_Int32 || b.rval == MIRType_Double,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Assigned: djvj)
References
Details
(Keywords: assertion, crash, testcase, Whiteboard: [jsbugmon:update])
Crash Data
Attachments
(2 files)
9.70 KB,
text/plain
|
Details | |
1.47 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
function b(z) { switch (z) { default: primarySandbox = newGlobal("new-compartment") } return function(f, code) { try { evalcx(code, primarySandbox) } catch (e) {} } } function a(code) { gc(); f = Function(code) c(f, code) } c = b() a("\ f2 = (function() {\ a0 + o2.m;\ a2.shift()\ });\ a2 = new Array;\ Object.defineProperty(a2, 0, {\ get: f2\ });\ o2 = {};\ a0 = [];\ a2.shift();\ var x;\ ") a("a0 = x") a("a2.shift()") asserts js debug shell on IonMonkey changeset e96d5b1f47b8 with --ion and -n at Assertion failure: b.rval == MIRType_Int32 || b.rval == MIRType_Double, and crashes js opt shell at js::ion::LinearScanAllocator::populateSafepoints ( Tested with a 32-bit opt shell compiled with --enable-more-deterministic )
Reporter | ||
Comment 1•12 years ago
|
||
The stacks are not infinite, but around 600-700+ lines long, nonetheless attaching the top 20 lines of both debug and opt shell stacks.
Updated•12 years ago
|
Version: Trunk → Other Branch
Comment 2•12 years ago
|
||
With the test in comment 0, I am only getting this assertion now: Assertion failure: unexpected type, at js/src/ion/Lowering.cpp:822 And it also pops up in optimized builds (it's a JS_NOT_REACHED). Gary, can you confirm that?
Reporter | ||
Comment 3•12 years ago
|
||
On Mac 10.7 32-bit debug js shells, with --ion -n, I still get: Assertion failure: rval == MIRType_Int32 || rval == MIRType_Double, and I still crash at js::ion::LinearScanAllocator::populateSafepoints in 32-bit opt builds.
Reporter | ||
Comment 4•12 years ago
|
||
> and I still crash at js::ion::LinearScanAllocator::populateSafepoints in
> 32-bit opt builds.
Likely a null deref:
(gdb) x/i $pc
0x251e1b <_ZN2js3ion19LinearScanAllocator18populateSafepointsEv+379>: mov 0x1c(%esi),%eax
(gdb) x/b $esi
0x0: Cannot access memory at address 0x0
(gdb) x/b $eax
0x16: Cannot access memory at address 0x16
Updated•12 years ago
|
Whiteboard: [jsbugmon:update]
Reporter | ||
Comment 5•12 years ago
|
||
Instead of the signature in comment 0, the 32-bit js opt shell crash signature is now at: js::ion::LIRGenerator::visitToInt32
Crash Signature: [@ js::ion::LinearScanAllocator::populateSafepoints] → [@ js::ion::LinearScanAllocator::populateSafepoints]
[@ js::ion::LIRGenerator::visitToInt32]
Summary: IonMonkey: Crash [@ js::ion::LinearScanAllocator::populateSafepoints] or "Assertion failure: b.rval == MIRType_Int32 || b.rval == MIRType_Double," → IonMonkey: Crash [@ js::ion::LinearScanAllocator::populateSafepoints] or [@ js::ion::LIRGenerator::visitToInt32] or "Assertion failure: b.rval == MIRType_Int32 || b.rval == MIRType_Double,"
Assignee | ||
Updated•12 years ago
|
Assignee: general → kvijayan
Assignee | ||
Comment 6•12 years ago
|
||
The problem is that the rval may possibly end up being MIRType_Value (in this test case, anyway), and the code simply asserts that rval is one of Int32 or Double, without allowing for other possibilities. Small patch to check for non-Int32-or-Double MIRTypes, choosing not to specialize in that case.
Attachment #624179 -
Flags: review?(jdemooij)
Comment 7•12 years ago
|
||
Comment on attachment 624179 [details] [diff] [review] Tentative patch Review of attachment 624179 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/MIR.cpp @@ +910,5 @@ > } > > MIRType rval = MIRTypeFromValueType(b.outTypes->getKnownTypeTag(cx)); > > + // Don't specialize for non-integer results. Nit: integer or double?
Attachment #624179 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 8•12 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/e14efc51f562
Updated•12 years ago
|
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Comment 9•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•