Closed
Bug 903028
Opened 11 years ago
Closed 11 years ago
Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla26
Tracking | Status | |
---|---|---|
firefox23 | --- | disabled |
firefox24 | --- | disabled |
firefox25 | --- | disabled |
firefox26 | --- | fixed |
firefox-esr17 | --- | unaffected |
b2g18 | --- | unaffected |
People
(Reporter: gkw, Assigned: shu)
Details
(4 keywords, Whiteboard: [jsbugmon:])
Attachments
(2 files)
ParallelArray([5477], function() { Array(function() {}) }) asserts js 64-bit debug threadsafe shell on m-c changeset fd4cf30428b0 with --ion-parallel-compile=on at Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp gc seems to be on the stack so setting s-s for now. Running autoBisect, tested on Windows 7. Assuming related to ParallelArrays for now.
Flags: needinfo?(shu)
Updated•11 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:]
Comment 1•11 years ago
|
||
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Assignee | ||
Comment 2•11 years ago
|
||
I can't reproduce this on Linux, but from the stack trace it's crashing due to the read barrier on TypeObject in OMTC when trying to make a new singleton type set for MLambdaPar. ParallelArraySafetyAnalysis might make new MIR nodes to replace unsafe ones. If OMTC is on, this happens off thread. I'm not really sure what's allowed/not allowed for OMTC, needinfo'ing bhackett.
Flags: needinfo?(shu) → needinfo?(bhackett1024)
Assignee | ||
Comment 3•11 years ago
|
||
This patch reuses existing type sets and so doesn't allocate any new type sets OMT. Not sure if this is the right fix, though. Also not sure if it fixes the crash since I can't reproduce it. Gary, could you check?
Attachment #787805 -
Flags: feedback?(bhackett1024)
Reporter | ||
Comment 4•11 years ago
|
||
(fwiw, I could repro this on 64-bit debug Windows, but I'll retest your patch tomorrow)
Reporter | ||
Updated•11 years ago
|
Attachment #787805 -
Flags: feedback?(gary)
Reporter | ||
Comment 5•11 years ago
|
||
Comment on attachment 787805 [details] [diff] [review] bug903028-omtc-safetyanalysis-alloc.patch This patch does seem to fix the issue.
Attachment #787805 -
Flags: feedback?(gary) → feedback+
Assignee | ||
Comment 6•11 years ago
|
||
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5) > Comment on attachment 787805 [details] [diff] [review] > bug903028-omtc-safetyanalysis-alloc.patch > > This patch does seem to fix the issue. I'd still wait for bhackett's input before blessing the fix as the proper one.
Comment 7•11 years ago
|
||
Comment on attachment 787805 [details] [diff] [review] bug903028-omtc-safetyanalysis-alloc.patch Review of attachment 787805 [details] [diff] [review]: ----------------------------------------------------------------- Yeah, we don't want to be triggering any read or write barriers while working off thread.
Attachment #787805 -
Flags: feedback?(bhackett1024) → feedback+
Comment 8•11 years ago
|
||
Is this really a "regression" if we don't know how far back it goes? Does ESR-17 or b2g18 support ParallelArrays?
Keywords: sec-high
Reporter | ||
Comment 9•11 years ago
|
||
I think Shu-yu once mentioned that ParallelArrays are only enabled on Nightly for now, but I'd like his confirmation.
Flags: needinfo?(shu)
Updated•11 years ago
|
Flags: needinfo?(bhackett1024)
Reporter | ||
Updated•11 years ago
|
Assignee: general → shu
Status: NEW → ASSIGNED
Updated•11 years ago
|
status-b2g18:
--- → unaffected
status-firefox23:
--- → disabled
status-firefox24:
--- → disabled
status-firefox25:
--- → disabled
status-firefox26:
--- → affected
status-firefox-esr17:
--- → unaffected
Assignee | ||
Comment 11•11 years ago
|
||
http://hg.mozilla.org/integration/mozilla-inbound/rev/d825964ccab6
Comment 12•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/d825964ccab6
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Reporter | ||
Comment 13•11 years ago
|
||
Comment on attachment 787805 [details] [diff] [review] bug903028-omtc-safetyanalysis-alloc.patch I'd figure that bhackett's feedback+ really means a r+ in this instance.
Attachment #787805 -
Flags: review+
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•