886104 - Assertion failure: false (ParCall'ed functions must have scripts or be ES6 bound functions.), at ion/ParallelFunctions.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

ParallelArray(99999, (function() {
    "use asm";
    function f() {}
    return f;
}));

asserts js debug shell on m-c changeset 4c4f75c20e9b without any CLI arguments at Assertion failure: false (ParCall'ed functions must have scripts or be ES6 bound functions.), at ion/ParallelFunctions.cpp

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A threadsafe shell is needed to reproduce this issue.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/3a535bd50a23
user:        Luke Wagner
date:        Mon Mar 25 15:12:44 2013 -0700
summary:     Bug 854448 - Fix debug-only null-deref in JSFunction::name (r=njn)

Luke, is bug 854448 a likely regressor?

Comment 3

[Luke Wagner [:luke]]

The bug is that the "use asm" lambda is a native (js::LinkAsmJS) and the DEBUG-only code in ion::ParCallToUncompiledScript does not expect a native().  I'm not sure whether the fix is just add a case to the assert or change somewhere else to prevent us from getting here; perhaps Niko/Shu could weigh in here?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting needinfo based on comment 3.

Comment 5

[Shu-yu Guo [:shu]]

Attachment: fix

Adding another case sounds good for me. The branch in the generated code in CallGeneric just branches on there being no script anyways, so it seems like to me the assert is bogus -- it could happen with sufficiently diluted TI info we could end up trying to call a native in parallel.

Comment 6

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/382e4fd8770e

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/382e4fd8770e