Closed Bug 859255 Opened 10 years ago Closed 10 years ago

Assertion failure: offset < script->length, at ion/CodeGenerator.cpp with ParallelArray and -D (--dump-bytecode)

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla23

People

(Reporter: gkw, Assigned: shu)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:])

Attachments

(2 files)

Attached file stack
ParallelArray(999,function([y]){})

asserts js debug shell on m-c changeset b0d842380959 with -D (or --dump-bytecode) at Assertion failure: offset < script->length, at ion/CodeGenerator.cpp

Running autoBisect now...
Summary: Assertion failure: offset < script->length, at ion/CodeGenerator.cpp → Assertion failure: offset < script->length, at ion/CodeGenerator.cpp with ParallelArray and -D (--dump-bytecode)
Whiteboard: [jsbugmon:update] → [jsbugmon:]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   127453:1aaed48de5e5
parent:      127452:71ff63071039
parent:      126478:962f5293f87f
user:        Jan de Mooij
date:        Thu Mar 28 11:26:32 2013 +0100
summary:     Merge from mozilla-central.

Not all ancestors of this changeset have been checked.
Use bisect --extend to continue the bisection from
the common ancestor, 5dbcbd03d7ba.

This iteration took 162.080 seconds to run.

Oops! We didn't test rev 962f5293f87f, a parent of the blamed revision! Let's do that now.
Rev 962f5293f87f: Updating... Compiling... Testing... good (Exit code 0)
As expected, the parent's label is the opposite of the blamed rev's label.

The bug was introduced by a merge (it was not present on either parent).
I don't know which patches from each side of the merge contributed to the bug. Sorry.


Jandem, this seems to point to BaselineCompiler - is this likely?
Flags: needinfo?(jdemooij)
Hm this looks like a ParallelArray issue, CC'ing Niko and Shu.
Flags: needinfo?(jdemooij)
Flags: needinfo?(nmatsakis)
Off the top of my head, I'd guess it's related to callsite cloning.  Shu, what do you think?
Flags: needinfo?(nmatsakis) → needinfo?
Flags: needinfo?
Attached patch fixSplinter Review
Assignee: general → shu
Attachment #736904 - Flags: review?(dvander)
Comment on attachment 736904 [details] [diff] [review]
fix

Review of attachment 736904 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/MIRGraph.cpp
@@ +167,4 @@
>  {
> +    MBasicBlock *block = new MBasicBlock(graph, info, entryPc, NORMAL);
> +
> +    resumePoint->block_ = block;

nit: use setBlock()

@@ +167,5 @@
>  {
> +    MBasicBlock *block = new MBasicBlock(graph, info, entryPc, NORMAL);
> +
> +    resumePoint->block_ = block;
> +    block->entryResumePoint_ = resumePoint;

nit: Use setResumePoint()
Attachment #736904 - Flags: review?(dvander) → review+
(In reply to David Anderson [:dvander] from comment #6)
> Comment on attachment 736904 [details] [diff] [review]
> fix
> 
> Review of attachment 736904 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: js/src/ion/MIRGraph.cpp
> @@ +167,4 @@
> >  {
> > +    MBasicBlock *block = new MBasicBlock(graph, info, entryPc, NORMAL);
> > +
> > +    resumePoint->block_ = block;
> 
> nit: use setBlock()
> 
> @@ +167,5 @@
> >  {
> > +    MBasicBlock *block = new MBasicBlock(graph, info, entryPc, NORMAL);
> > +
> > +    resumePoint->block_ = block;
> > +    block->entryResumePoint_ = resumePoint;
> 
> nit: Use setResumePoint()

Those helpers don't exist on MBasicBlock, only MInstruction. Do you want me to add them?
https://hg.mozilla.org/mozilla-central/rev/a1d95089b0b7
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.