813387 - IonMonkey: Crash [@ js::GetNextPc] or Opt-Crash [@ js::ion::InvalidationBailout]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 4fddb9923ef0 (run with --ion-eager):


function TestCase(n, d, e, a) {
  this.bugnumber = typeof(foo);
  dump('reason: ' + toPrinted(this.reason));
}
function reportCompare (expected, actual, description) {
  var expected_t = typeof expected;
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
}
var lfcode = new Array();
lfcode.push("3");
lfcode.push("\
var BUGNUMBER = 385393;\
var Ru;\
var actual = 'No Crash';\
var expect = 'No Crash';\
test();\
function test() {\
  try   {\
    test();\
  }  catch(ex)  {  }\
  reportCompare('', '', '');\
}\
");
while (true) {
	var file = lfcode.shift(); if (file == undefined) { break; }
        loadFile(file)
}
function loadFile(lfVarx) {
        if (lfVarx.substr(-3) != ".js" && lfVarx.length > 1) {
            switch (lfRunTypeId) {
                case 3: function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); break;
            }
        } else if (!isNaN(lfVarx)) {
            lfRunTypeId = parseInt(lfVarx);
    }
}

Comment 1

[Christian Holler (:decoder)]

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000000000087e366 in js::GetNextPc (pc=0x0) at ../jsopcode.h:651
651         return pc + js_CodeSpec[JSOp(*pc)].length;
(gdb) bt
#0  0x000000000087e366 in js::GetNextPc (pc=0x0) at ../jsopcode.h:651
#1  0x000000000088065c in js::ion::InvalidationBailout (sp=0x7fffffffbcc8, frameSizeOut=0x7fffffffbcc0) at /srv/repos/mozilla-central/js/src/ion/Bailouts.cpp:439
#2  0x00007ffff7fe8578 in ?? ()
#3  0x00007ffff600f280 in ?? ()

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   106741:6cd206b37176
parent:      106740:b63bb39ed1c0
parent:      103644:a0240c1043ee
user:        David Anderson
date:        Wed Aug 29 17:51:24 2012 -0700
summary:     Merge from mozilla-central.

Not all ancestors of this changeset have been checked.
Use bisect --extend to continue the bisection from
the common ancestor, 88e47f6905e9.

This iteration took 109.601 seconds to run.

Oops! We didn't test rev a0240c1043ee, a parent of the blamed revision! Let's do that now.
We did not test rev a0240c1043ee because it is not a descendant of either 4ceb3e9961e4 or 4fddb9923ef0.
Rev a0240c1043ee: Updating... Compiling... Testing... ['--timeout=10']
1
[Uninteresting] It didn't crash. (0.052 seconds)
good (not interesting) 
As expected, the parent's label is the opposite of the blamed rev's label.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unknown exception (check manually)

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision 524e7bc67431).

Comment 5

[Alexandre]

[Tracking Requested - why for this release]:

Firefox61 and 63 won't fix, finding a patch for 62...

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Extremely low volume crash. Not tracking for any releases.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 9

[Iain Ireland [:iain]]

The testcase in comment #1 no longer replicates. The code in which the failure occurred was part of Ion-to-baseline bailout handling, which was removed in bug 868431. Here's the diff: https://searchfox.org/mozilla-central/diff/52fb6ed8f1775f37c2d28569385b762197de587d/js/src/ion/Bailouts.cpp#133

Nothing left to do here. Resolving as fixed.