969778 - Crash [@ js::jit::LiveInterval::addRangeAtHead] or Assertion failure: false (MOZ_ASSUME_UNREACHABLE(unexpected type)), at jit/Lowering.cpp

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug and opt stacks

for (var aa = 0; aa < 999999; aa++) {
    try {
        Function("\
            (function() {})([NaN, , 0])\
        ")()
    } catch (e) {};
}


crashes js opt shell on m-c changeset cafe909f7e07 with --ion-eager at js::jit::LiveInterval::addRangeAtHead and asserts js debug shell at Assertion failure: false (MOZ_ASSUME_UNREACHABLE(unexpected type)), at jit/Lowering.cpp

My configure flags are: (opt)

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options>

Debug:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/dbeea0e93b56
user:        Brian Hackett
date:        Mon Dec 16 10:53:02 2013 -0800
summary:     Bug 785905 - Build Ion MIR graph off thread, r=jandem.

Brian, is bug 785905 a likely regressor?

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Error: Failed to compile specified revision cafe909f7e07 (maybe try another?)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Christian Holler (:decoder) from comment #1)
> JSBugMon: Cannot process bug: Error: Failed to compile specified revision
> cafe909f7e07 (maybe try another?)

Retry with a later revision that fixed non-threadsafe build compilation issues.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Brian Hackett [Laid off!]]

Bug 785905 has been backed out and I can't reproduce this.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yes, this is likely fixed by the backout, which has also landed in Aurora.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8c521a802625
parent:      168757:9e7cf0b1d80c
user:        Jan de Mooij
date:        Fri Feb 14 13:17:53 2014 +0100
summary:     Backout bug 785905, off-thread IonBuilder. r=jorendorff

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.