Closed Bug 886101 Opened 6 years ago Closed 6 years ago

Crash [@ js::DefaultValue] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
All
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla25

People

(Reporter: gkw, Assigned: shu)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker][jsbugmon:])

Crash Data

Attachments

(3 files)

Attached file stack
ParallelArray(86, function() {
    ({}) ^ 7
})

asserts js debug shell on m-c changeset 4c4f75c20e9b with Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

A threadsafe shell is needed to reproduce the issue.
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:bisect]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Whiteboard: [jsbugmon:bisect] → [jsbugmon:]
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/2bdb824158c6
user:        Nicholas D. Matsakis
date:        Sat May 25 09:05:05 2013 -0400
summary:     Bug 862892 - Support off-main-thread compilation for parallel execution. r=shu,bhackett

Nicholas, is bug 862892 a likely regressor?
Blocks: 862892
Flags: needinfo?(nmatsakis)
Attached file opt stack
This testcase causes a likely null deref in opt builds at js::DefaultValue, tested with a 64-bit opt threadsafe --enable-more-deterministic js shell.
Other testcases assert identically but crash at js::ion::HandleException instead.
Crash Signature: [@ js::DefaultValue] [@ js::ion::HandleException]
OS: Mac OS X → All
Summary: Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp → Crash [@ js::DefaultValue] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp
This happens pretty often. :(
Flags: needinfo?(shu)
Whiteboard: [jsbugmon:] → [fuzzblocker][jsbugmon:]
Attached patch fixSplinter Review
Assignee: general → shu
Attachment #768676 - Flags: review?(nmatsakis)
Flags: needinfo?(shu)
Flags: needinfo?(nmatsakis)
Attachment #768676 - Flags: review?(nmatsakis) → review+
https://hg.mozilla.org/mozilla-central/rev/1f94ac2ead06
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.