938431 - Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: lldb stack

function x() {}
ParallelArray(3385, function(y) {
    Object.defineProperty([], 8, {
        e: (y ? x : Math.fround(1))
    })
})

asserts js debug shell on m-c changeset 7b014f0f3b03 with --baseline-eager at Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --disable-threadsafe

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/13568a3576cd
user:        Benjamin Bouvier
date:        Thu Sep 12 14:54:01 2013 -0700
summary:     Bug 915301: Check Float32 coherency; r=sstangl

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Older forms of this assertion were marked s-s, e.g. bug 919522.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Patch and test case

Sets the MPostWriteBarrier as an always Float32 safe instruction. This makes sense as long as PostWriteBarriers only notify GC of Objects and Values. The modified function is called during the ApplyTypes phase, to check that there is no Float32 flowing into a non Float32-safe operator.

Comment 3

[Jon Coppeard (:jonco)]

Comment on attachment 832258 [details] [diff] [review]
Patch and test case

Review of attachment 832258 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fd55575b3350

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/fd55575b3350

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[Phil Ringnalda (:philor)]

Pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/e4b5ab3610da as a followup for the test, to bail when ParallelArray isn't defined, since it's only on the trunk.

Comment 8

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/e4b5ab3610da

Comment 9

[David Chan [:dchan]]

Per comment 0 b2g18 and b2g1.1 are unaffected. The first bad revision was in September so b2g1.2 may be affected.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Is there a reason this bug didn't go through sec-approval (and security rating) before checkin since it affects more than one branch?

https://wiki.mozilla.org/Security/Bug_Approval_Process

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Marking b2g 1.2 affected since it is based on 26, which is affected by this bug (along with 27).

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Can we please get Aurora/Beta/b2g26 uplift noms?

Comment 13

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 832258 [details] [diff] [review]
Patch and test case

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 888109
User impact if declined: crashes on certain scripts
Testing completed (on m-c, etc.): test added, testing completed on m-i, m-c for some time now
Risk to taking this patch (and alternatives if risky): no risk at all
String or IDL/UUID changes made by this patch: N/A

Comment 14

[Lukas Blakk [:lsblakk] use ?needinfo]

Looks like this actually only needs to get on Beta since 27 is already marked fixed.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/2765cb3f2d5e

Comment 16

[Ryan VanderMeulen [:RyanVM]]

FWIW, the b2g26 backport is green on Try.

Comment 17

[Preeti Raghunath(:Preeti)]

Comment on attachment 832258 [details] [diff] [review]
Patch and test case

Plus for approval‑mozilla‑b2g26: Regression

Comment 18

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g26_v1_2/rev/58883895d655