919522 - Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp:922 or Crash [@ js::jit::LIRGenerator::visitTruncateToInt32] with invalid read

Status: RESOLVED DUPLICATE of bug 915903

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision f97307cb4c95 (run with --fuzzing-safe --ion-eager):


function testFloat32SetElemIC(a) {
  for (var i = 0; i < a.length; i++) {
    var r = Math.fround(Math.random());
    a[i] = r;
  }
}
testFloat32SetElemIC(new Int8Array(2048));

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

This looks bad:

Program received signal SIGSEGV, Segmentation fault.
0x000000000074133a in js::jit::LIRGenerator::visitTruncateToInt32 (this=0x7fffffffb450, truncate=0x14cc1e8) at js/src/jit/Lowering.cpp:1699
1699        switch (opd->type()) {
#0  0x000000000074133a in js::jit::LIRGenerator::visitTruncateToInt32 (this=0x7fffffffb450, truncate=0x14cc1e8) at js/src/jit/Lowering.cpp:1699
#1  0x0000000000756e45 in visitInstruction (ins=0x14cc1e8, this=0x7fffffffb450) at js/src/jit/Lowering.cpp:3200
#2  js::jit::LIRGenerator::visitBlock (this=0x7fffffffb450, block=0x14ca040) at js/src/jit/Lowering.cpp:3292
#3  0x0000000000757194 in js::jit::LIRGenerator::generate (this=0x7fffffffb450) at js/src/jit/Lowering.cpp:3368
#4  0x00000000006c4be3 in js::jit::GenerateLIR (mir=0x1436758) at js/src/jit/Ion.cpp:1384
#5  0x00000000006c60dc in CompileBackEnd (mir=0x1436758, maybeMasm=<optimized out>) at js/src/jit/Ion.cpp:1487
#6  js::jit::IonCompile (cx=0x141a600, script=<optimized out>, baselineFrame=0x7fffffffc408, osrPc=0x14be870 "\343\001V", constructing=false, executionMode=<optimized out>) at js/src/jit/Ion.cpp:1656
#7  0x00000000006c6387 in js::jit::Compile (cx=0x141a600, script=..., osrFrame=0x7fffffffc408, osrPc=<optimized out>, constructing=<optimized out>, executionMode=js::jit::SequentialExecution) at js/src/jit/Ion.cpp:1814
rax     0x9dc6d0        10340048
rdx     0xfffefa81      4294900353
rip     0x74133a <js::jit::LIRGenerator::visitTruncateToInt32(js::jit::MTruncateToInt32*)+74>
=> 0x74133a <js::jit::LIRGenerator::visitTruncateToInt32(js::jit::MTruncateToInt32*)+74>:       movslq (%rax,%rdx,4),%rdx
   0x74133e <js::jit::LIRGenerator::visitTruncateToInt32(js::jit::MTruncateToInt32*)+78>:       add    %rdx,%rax


Marking sec-high based on crash.

Comment 3

[Luke Wagner [:luke]]

Could be the same as the inception demo crash.

Comment 4

[Luke Wagner [:luke]]

(That is, bug 919522)

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8621bdc40841
user:        Benjamin Bouvier
date:        Wed Sep 11 02:10:17 2013 -0700
summary:     Bug 900257: Inline Math.fround in IonMonkey; r=sstangl

This iteration took 364.573 seconds to run.