977674 - Assertion failure: GetIonScript(script, executionMode)->isRecompiling(), at jit/CodeGenerator.cpp:6183

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision a98a1d78817f (threadsafe build, run with --fuzzing-safe --thread-count=2 --ion-eager):


function testReduce() {
  function sum(a, b) {
    var r = a + b;
  }
  var array = build(8 * 0X0aaec , function() { return 1; });
  var parResult = array.reducePar(sum);
}
for (var ix = 0; ix < 3; ++ix) {
  testReduce();
}
function build(n, f) {
  var result = [];
  for (var i = 0; i < n; i++)
    result.push(f(i));
  return result;
}
function seq_scan(array, f) {
  for (var i = 1; i < array.length; i++) {
  }
}
function assertAlmostEq(v1, v2) {
    if (e1 instanceof Array && e2 instanceof Array) {
      for (prop in e1) {
        if (e1.hasOwnProperty(prop)) {        }
      }
    }
}
function assertEqArray(a, b) {
    for (var i = 0, l = a.length; i < l; i++) {
      try {      } catch (e) {      }
    }
}
function assertParallelExecWillRecover(opFunction) {
assertParallelExecSucceeds(
    function(m) {},
    function(r) {}
);
}

Comment 1

[Christian Holler (:decoder)]

This test requires multiple runs to reproduce, I cannot easily bisect it reliably therefore. Needinfo from Jan to either look at this or assign someone else since I have no clue who else is suitable :)

Comment 2

[Jan de Mooij [:jandem]]

Forwarding to Hannes as this looks related to optimization levels.

Comment 3

[Hannes Verschore [:h4writer]]

Taking. Bisect should give bug 939614.

Comment 4

[Hannes Verschore [:h4writer]]

Attachment: Only clear recompiling check if sequential compiling

Parallel compilation could reset the recompiling flag. This flag is only used to make sure we don't start a second recompile when the first isn't finished yet. So no real exploitable behaviour, only possibly more scheduled scripts (in edge-case scenario).

Comment 5

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d45173c0e338

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d45173c0e338