Closed Bug 886101 Opened 10 years ago Closed 10 years ago

Crash [@ js::DefaultValue] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla25

People

(Reporter: gkw, Assigned: shu)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker][jsbugmon:])

Crash Data

Attachments

(3 files)

stack
13.24 KB, text/plain
Details
opt stack
2.00 KB, text/plain
Details
fix
2.02 KB, patch
nmatsakis
: review+
Details | Diff | Splinter Review
Attached file stack — 
ParallelArray(86, function() {
    ({}) ^ 7
})

asserts js debug shell on m-c changeset 4c4f75c20e9b with Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

A threadsafe shell is needed to reproduce the issue.
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:bisect]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Whiteboard: [jsbugmon:bisect] → [jsbugmon:]
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/2bdb824158c6
user:        Nicholas D. Matsakis
date:        Sat May 25 09:05:05 2013 -0400
summary:     Bug 862892 - Support off-main-thread compilation for parallel execution. r=shu,bhackett

Nicholas, is bug 862892 a likely regressor?
Blocks: 862892
Flags: needinfo?(nmatsakis)
Attached file opt stack — 
This testcase causes a likely null deref in opt builds at js::DefaultValue, tested with a 64-bit opt threadsafe --enable-more-deterministic js shell.
Other testcases assert identically but crash at js::ion::HandleException instead.
Crash Signature: [@ js::DefaultValue] [@ js::ion::HandleException]
OS: Mac OS X → All
Summary: Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp → Crash [@ js::DefaultValue] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp
This happens pretty often. :(
Flags: needinfo?(shu)
Whiteboard: [jsbugmon:] → [fuzzblocker][jsbugmon:]
Attached patch fix — — Splinter Review 
Assignee: general → shu

        Attachment #768676 -
        Flags: review?(nmatsakis)
Flags: needinfo?(shu)
Flags: needinfo?(nmatsakis)

        Attachment #768676 -
        Flags: review?(nmatsakis) → review+

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/1f94ac2ead06
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25

          You need to log in
          before you can comment on or make changes to this bug.