784652 - IonMonkey: Opt-only crash on heap near [@ defaultValue]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase crashes on ionmonkey revision ab4f8a3762c6 (run with --ion -n -m --ion-eager).

Comment 1

[Christian Holler (:decoder)]

Only reproduces in an opt-build (and requires gczeal enabled there). Crash trace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff070f920 in ?? ()
Missing separate debuginfos, use: debuginfo-install zlib-1.2.3-27.el6.x86_64
(gdb) bt
#0  0x00007ffff070f920 in ?? ()
#1  0x00000000004b9e93 in defaultValue (cx=0xacb660, v=..., out=0x7fffffffc238) at ../jsobjinlines.h:73
#2  ToPrimitive (cx=0xacb660, v=..., out=0x7fffffffc238) at ../jsobjinlines.h:1328
#3  js::ToNumberSlow (cx=0xacb660, v=..., out=0x7fffffffc238) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/jsnum.cpp:1393
#4  0x00000000004ba66d in js::ToInt32Slow (cx=<value optimized out>, v=<value optimized out>, out=0x7fffffffc258) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/jsnum.cpp:1449
#5  0x0000000000784abf in ToInt32 (cx=0xacb660, lhs=<value optimized out>, rhs=..., out=0x7fffffffc29c) at ../jsapi.h:2845
#6  js::BitXor (cx=0xacb660, lhs=<value optimized out>, rhs=..., out=0x7fffffffc29c) at ../jsinterpinlines.h:886
#7  0x00007ffff7f46c84 in ?? ()
#8  0x00007fffffffc2c8 in ?? ()
#9  0x00007fffffffc29c in ?? ()
#10 0x00007ffff0711d00 in ?? ()
#11 0x00007fffffffc2a0 in ?? ()
#12 0x0000000000ab6ca0 in js::ion::CodeGenerator::visitBitOpV(js::ion::LBitOpV*)::BitLhsInfo ()
#13 0x00007ffff0714128 in ?? ()
#14 0x00007ffff7f47481 in ?? ()
#15 0x0000000000000440 in ?? () at ../assembler/assembler/AssemblerBuffer.h:104
#16 0xfffbfffff0715fc0 in ?? ()
[...]
(gdb) x /i $pc
=> 0x7ffff070f920:      mov    $0x10,%al
(gdb) info reg al
al             0x20     32

Comment 2

[Christian Holler (:decoder)]

I tried reproducing this on mozilla-central fdfaef738a00 but failed. Also JSBugMon can't track this because it's an opt-only issue.

Comment 3

[Sean Stangl [:sstangl]]

Works for me, --enable-optimize --disable-debug --enable-gczeal, with --ion-eager.
Decoder, can you verify?

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Christian, I can't reproduce this on the given cset either. Do we need some precise build flags, or should we get access to your test machine again?

Comment 5

[Christian Holler (:decoder)]

WFM on tip too, shall we just close this?

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Yeah, sgtm.