Crash [@ JSContext::runtime] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: gkw, Assigned: shu)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
All
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 771573 [details]
stack

x = Uint8ClampedArray()
ParallelArray([320], function() {
    return x[8]
})

asserts js debug threadsafe shell on m-c changeset 17fe59f6c54a with Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

I'm guessing that this may involve ParallelArrays again, just like bug 886101.
Flags: needinfo?(shu)
(Assignee)

Comment 1

6 years ago
Created attachment 771617 [details] [diff] [review]
fix
Assignee: general → shu
Attachment #771617 - Flags: review?(nmatsakis)
Flags: needinfo?(shu)
(Reporter)

Comment 2

6 years ago
This testcase crash 64-bit opt js shell at JSContext::runtime and I suspect it may also cause crashes at js::ion::HandleException as well.
Crash Signature: [@ JSContext::runtime] [@ js::ion::HandleException]
Summary: Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp → Crash [@ JSContext::runtime] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp
My patch for bug 829896 also solves this problem, but in a nicer way.
Depends on: 829896
Comment on attachment 771617 [details] [diff] [review]
fix

Review of attachment 771617 [details] [diff] [review]:
-----------------------------------------------------------------

Preferred fix is in bug 829896
Attachment #771617 - Flags: review?(nmatsakis) → review-
The patch for bug 829896 (attachment 773939 [details] [diff] [review]) included a test for this bug. I'm not sure of the proper protocol here, should I mark this bug resolved?
Flags: needinfo?(gary)
(Reporter)

Comment 6

6 years ago
Yes.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: needinfo?(gary) → in-testsuite+
Resolution: --- → FIXED
(Reporter)

Comment 7

6 years ago
And VERIFIED too, since a testcase has landed.

Thank you!
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.