908625 - Crash [@ js::ion::MBasicBlock::lastIns] or Opt-Crash [@ js::ion::MBasicBlock::getSuccessor] with try-catch compilation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision fb2318875cd4 (threadsafe build, run with --fuzzing-safe --ion-compile-try-catch --ion-eager):


var a = [];
function gramps(a, i) {}
for (;;) {
  try {
    k++;
  } catch(e) {
    break;
  }	
}
for (var i = 0; i < 9; i++)
  gramps(a, i);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Assigned to Jan because this is with --ion-compile-try-catch :)

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

Ion does not compile catch blocks, so if the OSR pc is only reachable through a break statement inside a catch block, IonBuilder thinks it's unreachable. This patch just aborts for now since it's kind of an edge case.

(This bug seems to be the only remaining try-catch fuzz bug, will file a new bug to enable try-catch compilation by default.)

Comment 4

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/43cb81ce502b

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/43cb81ce502b