886144 - Crash [@ setOperand] or [@ js::ion::MPhi::addInput] or Assertion failure: pred->stackPosition_ == stackPosition_ + popped, at ion/MIRGraph.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    Array.prototype.map();
} catch (e) {}
ParallelArray([99], function() {
    [].map(decodeURIComponent)
})

asserts js debug shell on m-c changeset 4c4f75c20e9b without any CLI arguments at Assertion failure: pred->stackPosition_ == stackPosition_ + popped, at ion/MIRGraph.cpp

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This testcase causes a likely null deref in opt builds at setOperand with js::ion::MPhi::addInput on the stack, tested with a 64-bit opt threadsafe --enable-more-deterministic js shell.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Opt stack

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: bisection log

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

From the bisection log, I'm guessing this is due to parallelarrays, bug 829602:

http://hg.mozilla.org/mozilla-central/rev/b00eb1ef1517

Comment 5

[Shu-yu Guo [:shu]]

Attachment: fix

ThrowError was being very incorrectly inlined in parallel execution to a MParBailout. But moreover, it would bail out anyways because it would result in a native function call, so I just removed the inlining.

Comment 6

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5a4080dc2257

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/5a4080dc2257