Last Comment Bug 783421 - Crash [@ js::mjit::JITScript::chunkIndex] or [@ js::mjit::Recompiler::patchFrame] or "Assertion failure: found,"
: Crash [@ js::mjit::JITScript::chunkIndex] or [@ js::mjit::Recompiler::patchFr...
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla17
Assigned To: [PTO to Dec5] Bill McCloskey (:billm)
: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz langfuzz 781390
  Show dependency treegraph
Reported: 2012-08-16 17:07 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-21 05:13 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (8.58 KB, text/plain)
2012-08-16 17:07 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
stack from a crash (8.37 KB, text/plain)
2012-08-16 17:17 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
patch (1.11 KB, patch)
2012-08-17 10:52 PDT, [PTO to Dec5] Bill McCloskey (:billm)
dvander: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-08-16 17:07:14 PDT
Created attachment 652626 [details]

var p = n
function m() {
  return function(f, code, t) {
	try {
	  evalcx(code, newGlobal())
	} catch (e) {}
function n() {
function h(code) {
	f = Function(code)
	p(f, code, true)

asserts js debug shell on m-c changeset 50e4ff05741e with -m, -n and -a at Assertion failure: found, when the testcase is passed in as a CLI argument, and a variant crashes at js::mjit::JITScript::chunkIndex with js::mjit::Recompiler::patchFrame on the stack

s-s because this involves gc but inspection of the registers seems to indicate that this is a null crash.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   102448:07f21ec5d516
user:        Bill McCloskey
date:        Wed Aug 15 10:39:48 2012 -0700
summary:     Bug 781390 - Make barrier verifier testing work better with the methodjit (r=bhackett)
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-08-16 17:17:58 PDT
Created attachment 652629 [details]
stack from a crash

Setting [fuzzblocker] because this is happening very very often.

p = n
function m(sandboxType) {
  switch (sandboxType) {
	a = newGlobal()
  return function(f, code, t) {
	try {
	  evalcx(code, a)
	} catch (e) {}
function n() {
function h(code) {
  f = Function(code)
  p(f, code, true)
h("(1 in f)")

is the other testcase that crashes instead.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-08-16 17:24:23 PDT
Other assertions like:

Assertion failure: thing,
Assertion failure: thing->compartment(),
Assertion failure: bi->aliased(),

I'm going to temporarily assume that this is the same bug because this is overflowing my logs...
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-08-16 18:26:32 PDT
Assertion failure: bi->aliased(), is actually bug 783441.
Comment 4 Christian Holler (:decoder) 2012-08-17 05:40:29 PDT
Also seeing this with varying signatures, would be very nice to have this fixed quickly for fuzzing.
Comment 5 [PTO to Dec5] Bill McCloskey (:billm) 2012-08-17 10:52:21 PDT
Created attachment 652830 [details] [diff] [review]

Sorry, stupid bug. I forgot that ClearAllFrames looks at the current needsBarrier()/compileBarriers() value. And the value of compileBarriers() is affected by the GC zeal. So we need to ClearAllFrames before updating the zeal or else it will try to purge the wrong stuff.
Comment 6 [PTO to Dec5] Bill McCloskey (:billm) 2012-08-17 18:51:18 PDT
Comment 7 Ryan VanderMeulen [:RyanVM] 2012-08-18 04:25:56 PDT
Comment 8 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2012-09-19 10:35:36 PDT
Since this has a testcase, nominating it for in-testsuite.
Comment 9 Manuela Muntean [Away] 2012-11-05 05:37:19 PST
I've tried several times, but I couldn't reproduce this bug. I will try on a different machine.
Comment 10 Manuela Muntean [Away] 2012-11-05 06:20:30 PST
Setting this to "qa?" and removing "verifyme" for the time being.

 Could I get some more info on how to reproduce this bug please?
Comment 11 Gary Kwong [:gkw] [:nth10sd] 2012-11-06 01:02:37 PST
You'll have to compile a shell from m-c changeset 50e4ff05741e in comment 0 with the shell flags specified. If you cannot reproduce with a 64-bit shell, try using the configure options in bug 781343 comment 2 to get a 32-bit shell to get it to reproduce.
Comment 12 Manuela Muntean [Away] 2012-11-09 06:31:40 PST
While trying to build Firefox on Ubuntu 12.04 (which is up-to-date), I get the following error:

Could you please help me solve this?
Comment 13 Gary Kwong [:gkw] [:nth10sd] 2012-11-09 09:10:24 PST
> Could you please help me solve this?

You need to first install "ia32-libs gcc-multilib g++-multilib" via apt-get, I think.
Comment 14 Manuela Muntean [Away] 2012-11-12 06:27:40 PST
Even after using the command you suggested:

  sudo apt-get install ia32-libs-multiarch gcc-multilib g++-multilib  

(only using "ia32-libs" didn't seem to work), I still receive the same error as in comment 26, when running the configure command in comment 2.
Comment 15 Christian Holler (:decoder) 2013-01-19 14:14:29 PST
Automatically extracted testcase for this bug was committed:
Comment 16 Manuela Muntean [Away] 2013-01-21 05:13:55 PST
According to the automated test provided in comment 15, marking this [qa-].

Note You need to log in before you can comment on or make changes to this bug.