890465 - Crash [@ JSContext::runtime] or [@ js::ion::HandleException] or Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = Uint8ClampedArray()
ParallelArray([320], function() {
    return x[8]
})

asserts js debug threadsafe shell on m-c changeset 17fe59f6c54a with Assertion failure: fun.executionMode == gen->info().executionMode(), at ion/shared/CodeGenerator-shared.cpp

I'm guessing that this may involve ParallelArrays again, just like bug 886101.

Comment 1

[Shu-yu Guo [:shu]]

Attachment: fix

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This testcase crash 64-bit opt js shell at JSContext::runtime and I suspect it may also cause crashes at js::ion::HandleException as well.

Comment 3

[Niko Matsakis [:nmatsakis]]

My patch for bug 829896 also solves this problem, but in a nicer way.

Comment 4

[Niko Matsakis [:nmatsakis]]

Comment on attachment 771617 [details] [diff] [review]
fix

Review of attachment 771617 [details] [diff] [review]:
-----------------------------------------------------------------

Preferred fix is in bug 829896

Comment 5

[Niko Matsakis [:nmatsakis]]

The patch for bug 829896 (attachment 773939 [details] [diff] [review]) included a test for this bug. I'm not sure of the proper protocol here, should I mark this bug resolved?

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yes.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

And VERIFIED too, since a testcase has landed.

Thank you!