The default bug view has changed. See this FAQ.

Assertion failure: pn, at ion/AsmJS.cpp:1159 or Crash [@ ~ModuleCompiler]

VERIFIED FIXED in Firefox 23

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: bbouvier)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla24
x86
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox23 fixed, firefox24 verified)

Details

Attachments

(2 attachments, 3 obsolete attachments)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision 41ff3b67b692 (run with --ion-eager):


assertEq((function() {
  'use asm';
  function _main() {
    var $1=0, $2=0, $3=0, $4=0, $5=0, $6=0, $7=0, $8=0, $9=0, $10=0, label=0;
      switch (label | 0) {
       case 1:
       case (2147483647):
    }
  }
  return _main;
})()(), 1);
(Reporter)

Comment 1

4 years ago
Created attachment 747014 [details]
[crash-signature] Machine-readable crash signature
(Assignee)

Updated

4 years ago
Assignee: general → bbouvier
(Assignee)

Comment 2

4 years ago
Created attachment 747037 [details] [diff] [review]
proposed fix

This crash would happen as in CheckSwitchRange, if the switch table is larger than 512Mb, fail would be called with stmt, which is NULL here (end condition of the for loop above).
Attachment #747037 - Flags: review?(luke)

Comment 3

4 years ago
Comment on attachment 747037 [details] [diff] [review]
proposed fix

Nice, thanks!
Attachment #747037 - Flags: review?(luke) → review+
(Assignee)

Comment 4

4 years ago
Created attachment 747098 [details] [diff] [review]
proposed fix compatible with tip

Oops, forgot to pull tip before making the patch.
This version is compatible with tip.
Attachment #747037 - Attachment is obsolete: true
(Reporter)

Comment 5

4 years ago
Created attachment 754428 [details]
[crash-signature] Machine-readable crash signature
Attachment #747014 - Attachment is obsolete: true
(Assignee)

Comment 6

4 years ago
Created attachment 754629 [details] [diff] [review]
Same fix with qref

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 870007
User impact if declined: low.
Risk to taking this patch (and alternatives if risky): no risk.

Same patch file as the one reviewed by Luke.
Attachment #747098 - Attachment is obsolete: true
Attachment #754629 - Flags: review+
Attachment #754629 - Flags: approval-mozilla-aurora?
(Assignee)

Updated

4 years ago
Keywords: checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/50d9e3c1574f
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/50d9e3c1574f
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla24

Updated

4 years ago
Attachment #754629 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/1e5d085c9b12
status-firefox23: --- → fixed
status-firefox24: --- → fixed
Running jsshell-win32 from a build before the fix with the testcase I got:
"Assertion failure: pn, at e:/builds/moz2_slave/m-cen-w32-d-000000000000000000/bu
ild/js/src/ion/AsmJS.cpp:1175"

After the fix (FF 24b5):
"test.js:6:7 warning: asm.js type error: all switch statements generate tables; t
his table would be too big
test.js:11:0 Error: Assertion failed: got (void 0), expected 1"

Is it ok ?
Flags: needinfo?(choller)
(Reporter)

Comment 11

4 years ago
Yes, this is likely correct :)
Flags: needinfo?(choller)
Thanks Christian. Verified based on comment 11
Status: RESOLVED → VERIFIED
status-firefox24: fixed → verified
Off-topic: Why do I get on Linux "No such file or directory" error when trying to run ./js from jsshell-linux-i686.zip ?
You need to log in before you can comment on or make changes to this bug.