936004 - Assertion failure: is<CallObject>() || is<ClonedBlockObject>(), at ../vm/ScopeObject.h:771 Crash [@ slotSpan] or Crash [@ js::jit::MacroAssembler::initGCThing]

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 70de5e24d79b (run with --fuzzing-safe --ion-eager):


function f(... f)  {
    function g() {
        gc();
    }
    g();
}
function h() {
    f([false, true]) = Math.floor(-0);
}
f();
h();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Looks like a critical crash on 64 bit:

Program received signal SIGSEGV, Segmentation fault.
js::jit::MacroAssembler::initGCThing (this=0x15058b0, obj=..., templateObject=0x7ffff694ef40) at  js/src/jit/IonMacroAssembler.cpp:825
825         if (templateObject->hasPrivate()) {
#0  js::jit::MacroAssembler::initGCThing (this=0x15058b0, obj=..., templateObject=0x7ffff694ef40) at  js/src/jit/IonMacroAssembler.cpp:825
#1  0x000000000068dd71 in js::jit::CodeGenerator::visitRest (this=0x1505870, lir=0x15007a8) at  js/src/jit/CodeGenerator.cpp:5586
#2  0x000000000068b23f in js::jit::CodeGenerator::generateBody (this=0x1505870) at  js/src/jit/CodeGenerator.cpp:2837
#3  0x000000000068df24 in js::jit::CodeGenerator::generate (this=0x1505870) at  js/src/jit/CodeGenerator.cpp:5706
#4  0x00000000006aae28 in GenerateCode (lir=0x1500198, mir=0x144bcb8, maybeMasm=<optimized out>) at  js/src/jit/Ion.cpp:1461
#5  CompileBackEnd (mir=0x144bcb8, maybeMasm=<optimized out>) at  js/src/jit/Ion.cpp:1480
#6  js::jit::IonCompile (cx=0x1439790, script=0x144bcb8, baselineFrame=0x0, osrPc=0x7fffffffbb00 "", constructing=false, executionMode=js::SequentialExecution) at  js/src/jit/Ion.cpp:1678
#7  0x00000000006ab034 in js::jit::Compile (cx=0x1439790, script=..., osrFrame=<optimized out>, osrPc=<optimized out>, constructing=<optimized out>, executionMode=js::SequentialExecution) at  js/src/jit/Ion.cpp:1824
rax     0x4d055000      5587161088
rip     0x70d5b0 <js::jit::MacroAssembler::initGCThing(js::jit::Register const&, JSObject*)+1472>
=> 0x70d5b0 <js::jit::MacroAssembler::initGCThing(js::jit::Register const&, JSObject*)+1472>:   testb  $0x1,0x8(%rax)


Also causes various other signatures, marking sec-critical.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

Rest_Fallback ICs weren't being marked properly.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/3f88f1e41372
user:        Brian Hackett
date:        Tue Nov 05 17:54:29 2013 -0800
summary:     Bug 935027 - Don't create 'rest' template objects in IonBuilder, r=jandem.

This iteration took 424.723 seconds to run.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/92499f6abfa8

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/92499f6abfa8

Comment 8

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.