886101 - Crash [@ js::DefaultValue] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

ParallelArray(86, function() {
    ({}) ^ 7
})

asserts js debug shell on m-c changeset 4c4f75c20e9b with Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

A threadsafe shell is needed to reproduce the issue.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/2bdb824158c6
user:        Nicholas D. Matsakis
date:        Sat May 25 09:05:05 2013 -0400
summary:     Bug 862892 - Support off-main-thread compilation for parallel execution. r=shu,bhackett

Nicholas, is bug 862892 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: opt stack

This testcase causes a likely null deref in opt builds at js::DefaultValue, tested with a 64-bit opt threadsafe --enable-more-deterministic js shell.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Other testcases assert identically but crash at js::ion::HandleException instead.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This happens pretty often. :(

Comment 6

[Shu-yu Guo [:shu]]

Attachment: fix

Comment 7

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1f94ac2ead06

try: https://tbpl.mozilla.org/?tree=Try&rev=dcc924a0d06e

Comment 8

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/1f94ac2ead06