Crash [@ js::jit::LiveInterval::addRangeAtHead] or Assertion failure: false (MOZ_ASSUME_UNREACHABLE(unexpected type)), at jit/Lowering.cpp

VERIFIED FIXED in Firefox 29

Status

()

--
critical
VERIFIED FIXED
5 years ago
3 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, 5 keywords)

Trunk
mozilla30
x86_64
Mac OS X
assertion, crash, regression, sec-high, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox28 unaffected, firefox29 fixed, firefox30 fixed, firefox-esr24 unaffected, b2g-v1.3 unaffected)

Details

(Whiteboard: [jsbugmon:origRev=6c899a1064f3], crash signature)

Attachments

(1 attachment)

Created attachment 8372780 [details]
debug and opt stacks

for (var aa = 0; aa < 999999; aa++) {
    try {
        Function("\
            (function() {})([NaN, , 0])\
        ")()
    } catch (e) {};
}


crashes js opt shell on m-c changeset cafe909f7e07 with --ion-eager at js::jit::LiveInterval::addRangeAtHead and asserts js debug shell at Assertion failure: false (MOZ_ASSUME_UNREACHABLE(unexpected type)), at jit/Lowering.cpp

My configure flags are: (opt)

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options>

Debug:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/dbeea0e93b56
user:        Brian Hackett
date:        Mon Dec 16 10:53:02 2013 -0800
summary:     Bug 785905 - Build Ion MIR graph off thread, r=jandem.

Brian, is bug 785905 a likely regressor?
Flags: needinfo?(bhackett1024)
Whiteboard: [jsbugmon:update] → [jsbugmon:]
JSBugMon: Cannot process bug: Error: Failed to compile specified revision cafe909f7e07 (maybe try another?)
(In reply to Christian Holler (:decoder) from comment #1)
> JSBugMon: Cannot process bug: Error: Failed to compile specified revision
> cafe909f7e07 (maybe try another?)

Retry with a later revision that fixed non-threadsafe build compilation issues.
Whiteboard: [jsbugmon:] → [jsbugmon:update,origRev=6c899a1064f3]
Whiteboard: [jsbugmon:update,origRev=6c899a1064f3] → [jsbugmon:origRev=6c899a1064f3]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Keywords: sec-high
status-firefox29: --- → affected
status-firefox30: --- → affected
(Assignee)

Comment 4

5 years ago
Bug 785905 has been backed out and I can't reproduce this.
Flags: needinfo?(bhackett1024)
Yes, this is likely fixed by the backout, which has also landed in Aurora.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8c521a802625
parent:      168757:9e7cf0b1d80c
user:        Jan de Mooij
date:        Fri Feb 14 13:17:53 2014 +0100
summary:     Backout bug 785905, off-thread IonBuilder. r=jorendorff
Status: NEW → RESOLVED
Last Resolved: 5 years ago
status-firefox29: affected → fixed
status-firefox30: affected → fixed
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Assignee: nobody → bhackett1024
status-firefox28: --- → unaffected
Target Milestone: --- → mozilla30
status-b2g-v1.3: --- → unaffected
status-firefox-esr24: --- → unaffected
Group: core-security
You need to log in before you can comment on or make changes to this bug.