919518 - Crash [@ js::jit::IonBuilder::getSingletonPrototype] or Crash [@ getType]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision f97307cb4c95 (run with --fuzzing-safe --ion-eager):


function TestCase() TestCase.prototype.dump = function () {}
function reportCompare () new TestCase();
test();
function test() {
  try  { 
    try { 
      test();
    } finally {  }
  } catch(ex)  {
    reportCompare();
  }
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/72681e08a35d
user:        Brian Hackett
date:        Fri Sep 20 07:43:46 2013 -0600
summary:     Bug 918116 - Don't delazify scripts during Ion compilation, r=jandem.

This iteration took 401.724 seconds to run.

Comment 5

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 6

[Kyle Wooten]

Thanks!

Comment 7

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 8

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision ddd03c32fab1).

Comment 9

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f613d7363bd2
user:        Brian Hackett
date:        Mon Oct 14 12:13:41 2013 -0600
summary:     Bug 924611 - Don't create lazy type objects and type properties in IonBuilder, r=jandem.

This iteration took 427.394 seconds to run.

Comment 10

[Christian Holler (:decoder)]

Very likely fixed by the refactorings in bug 924611.