902744 - Assertion failure: mir->type() != MIRType_Value, at ion/shared/Lowering-shared-inl.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(code) {
    try {
        Function(code)()
    } catch (e) {}
}
f("\
    x = ArrayBuffer;\
    Object.defineProperty(this, \"m\", {\
        get: function() {\
            y.scatter([0, 0], undefined, f1)\
        }\
    });\
    y = new ParallelArray;\
    z = y.shape;\
    Array.prototype.push.call(z, x);\
    f1 = (function() {\
        y.scan(function() {})\
    });\
    Array.prototype.reverse.call(z);\
    Object.defineProperty(z, 7, {\
        get: f1,\
    });\
    Array.prototype.pop.call(z);\
");
f("\
    Array.prototype.reverse.call(z);\
");
f("\
    m;\
");
f("\
    y = ParallelArray(6, function(){});\
    m;\
    m;\
")

asserts js debug 32-bit threadsafe shell on m-c changeset 79b5c74ef97b with --baseline-eager at Assertion failure: mir->type() != MIRType_Value, at ion/shared/Lowering-shared-inl.h

Tested on Windows 7. The patch in bug 901391 does not fix this problem. s-s because that bug seems s-s. Will try running autoBisect.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Shu-yu Guo [:shu]]

Attachment: bug902744.patch

Unrelated to bug 901391. This is a longer standing bug due to incorrect inlining of the NewDenseArray intrinsic.

Comment 3

[Shu-yu Guo [:shu]]

I can't r? :nmatsakis on the patch, bugzilla complains about incorrect user groups.

decoder, what's up with that?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Niko needs to be cc'ed first as he does not have access to s-s bugs by default.

Comment 5

[Shu-yu Guo [:shu]]

But it used to auto cc the reviewer, no?

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Shu-yu Guo [:shu] from comment #5)
> But it used to auto cc the reviewer, no?

The auto-cc only works if he has permissions to view the bug (prior to being cc'ed), in this case, the security bugs.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ed26fdbe8444
user:        Shu-yu Guo
date:        Sat May 04 20:53:21 2013 -0700
summary:     Bug 646597 - Make functions made by the Function constructor compile-and-go. Most of patch was originally written by jorendorff. (r=luke)

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Assuming bug 646597 is the correct regressor, this means this bug goes back to Firefox 23.

Comment 9

[Shu-yu Guo [:shu]]

That's not really the regressor. this probably has been around since we landed self hosted parallel arrays

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Shu-yu Guo [:shu] from comment #9)
> That's not really the regressor. this probably has been around since we
> landed self hosted parallel arrays

Probably bug 829602 then? Which means it goes back to Firefox 22.

Comment 11

[Shu-yu Guo [:shu]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #10)
> (In reply to Shu-yu Guo [:shu] from comment #9)
> > That's not really the regressor. this probably has been around since we
> > landed self hosted parallel arrays
> 
> Probably bug 829602 then? Which means it goes back to Firefox 22.

Code was added in 807853 but had no way to be triggered until 829602.

Comment 12

[Shu-yu Guo [:shu]]

Keep in mind that while it goes back to FF22, ParallelArray is *ifdef'd out* on everything but Nightly, so that code has no way to be triggered afaik outside of Nightly.

Comment 13

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Shu-yu Guo [:shu] from comment #12)
> Keep in mind that while it goes back to FF22, ParallelArray is *ifdef'd out*
> on everything but Nightly, so that code has no way to be triggered afaik
> outside of Nightly.

Adjusting flags as follows.

Comment 14

[Carsten Book [:Tomcat]]

might be worth also a testcase or ? :) 

fixed in mozilla-central

https://hg.mozilla.org/mozilla-central/rev/928f0878d1cd

Comment 15

[Lukas Blakk [:lsblakk] use ?needinfo]

Tracking so we can verify this fix.