"Assertion failure: L.isSet()" with gcPreserveCode()

RESOLVED FIXED in mozilla15

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: Jesse Ruderman, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla15
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox15-)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
./js -m -a -n

function f(t)
{
    for (var i = 0; i < 1; ++i) {
        if (typeof(t) != "string") {
        }
    }
}
function m(d)
{
    if (d == 0)
        return "";
    f(m(d - 1));
}
m(1);
gcPreserveCode();
mjitChunkLimit(1);
gcslice(0);
m(1);
gc();
m(2);

Assertion failure: L.isSet(), at js/src/methodjit/Compiler.cpp:1408

Regression from:
  https://hg.mozilla.org/mozilla-central/rev/fbff86190de6 (bug 750834)

This was a mix of fuzzer-generated code with the fuzzer itself. m() and f() are reduced from parts of jsfunfuzz.
(Reporter)

Updated

5 years ago
tracking-firefox15: --- → ?
(Assignee)

Comment 1

5 years ago
Created attachment 625419 [details] [diff] [review]
patch

Mmmm, gcPreserveCode() doesn't play well with mjitChunkLimit().  The latter needs to clear out old code so that the new chunk limit will be reflected in future compilations, but this behavior is prevented by the former.  The fix watches for this case and throws in mjitChunkLimit().
Assignee: general → bhackett1024
Attachment #625419 - Flags: review?(dvander)
Attachment #625419 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/ce618ce8d84a

Comment 3

5 years ago
https://hg.mozilla.org/mozilla-central/rev/ce618ce8d84a
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
Fixed on 15, no need to track.
tracking-firefox15: ? → -
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.