854034 - IonMonkey: Crash [@ js::CloneFunctionAtCallsite] or Assertion failure: hasScript(), at jsfun.h

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

try {
    [].some(ParallelArray.prototype.map)
} catch (e) {}
for (var z = 0; z < 9; z++) {
    [1].some(Float32Array)
}

crashes js opt shell on ionmonkey changeset f035cd0ee56e with --ion-eager at js::CloneFunctionAtCallsite and asserts js debug shell at Assertion failure: hasScript(), at jsfun.h

s-s because there is a bunch of memory addresses on the stack.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I also tested this with a threadsafe and --enable-more-deterministic, not sure if the latter is needed.

Comment 2

[Kannan Vijayan [:djvj]]

This also asserts on mozilla-inbound.  Seems to be related to revision a04dde344d24.

Comment 3

[Kannan Vijayan [:djvj]]

Attachment: Patch.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   125947:b00eb1ef1517
user:        Nicholas D. Matsakis
date:        Tue Mar 19 22:12:27 2013 -0400
summary:     Bug 829602 - Enable self-hosted parallelarray r=dvander,till

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Only nightly is affected, this can likely go in without sec-approval.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(I've let djvj via IRC know that I'll be setting checkin-needed here to fix fuzzer issues, hope that this sticks)

Comment 7

[Kannan Vijayan [:djvj]]

Pushed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6c50015e2073

Comment 8

[Joe Drew (not getting mail)]

https://hg.mozilla.org/mozilla-central/rev/6c50015e2073

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.