Closed Bug 977674 Opened 6 years ago Closed 6 years ago

Assertion failure: GetIonScript(script, executionMode)->isRecompiling(), at jit/CodeGenerator.cpp:6183

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla30
Tracking Status
firefox29 --- affected
firefox30 --- affected

People

(Reporter: decoder, Assigned: h4writer)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:ignore])

Attachments

(1 file)

The following testcase asserts on mozilla-central revision a98a1d78817f (threadsafe build, run with --fuzzing-safe --thread-count=2 --ion-eager):


function testReduce() {
  function sum(a, b) {
    var r = a + b;
  }
  var array = build(8 * 0X0aaec , function() { return 1; });
  var parResult = array.reducePar(sum);
}
for (var ix = 0; ix < 3; ++ix) {
  testReduce();
}
function build(n, f) {
  var result = [];
  for (var i = 0; i < n; i++)
    result.push(f(i));
  return result;
}
function seq_scan(array, f) {
  for (var i = 1; i < array.length; i++) {
  }
}
function assertAlmostEq(v1, v2) {
    if (e1 instanceof Array && e2 instanceof Array) {
      for (prop in e1) {
        if (e1.hasOwnProperty(prop)) {        }
      }
    }
}
function assertEqArray(a, b) {
    for (var i = 0, l = a.length; i < l; i++) {
      try {      } catch (e) {      }
    }
}
function assertParallelExecWillRecover(opFunction) {
assertParallelExecSucceeds(
    function(m) {},
    function(r) {}
);
}
This test requires multiple runs to reproduce, I cannot easily bisect it reliably therefore. Needinfo from Jan to either look at this or assign someone else since I have no clue who else is suitable :)
Flags: needinfo?(jdemooij)
Whiteboard: [jsbugmon:ignore]
Forwarding to Hannes as this looks related to optimization levels.
Flags: needinfo?(jdemooij) → needinfo?(hv1989)
Taking. Bisect should give bug 939614.
Assignee: nobody → hv1989
Flags: needinfo?(hv1989)
Parallel compilation could reset the recompiling flag. This flag is only used to make sure we don't start a second recompile when the first isn't finished yet. So no real exploitable behaviour, only possibly more scheduled scripts (in edge-case scenario).
Attachment #8388479 - Flags: review?(jdemooij)
Attachment #8388479 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/d45173c0e338
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Depends on: 984063
You need to log in before you can comment on or make changes to this bug.