991217 - Assertion failure: IsCompatibleLIRCoercion(def->type(), as->type()), at jit/shared/Lowering-shared-inl.h:195 or Crash on Heap with invalid read/write

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 4941a2ac0786 (threadsafe build, run with --fuzzing-safe --thread-count=2):


gczeal(4);
setJitCompilerOption("ion.usecount.trigger", 30);
var N2 = 150;
var T = TypedObject;
var Array2 = T.uint32.array(N2);
function foo() {
  var array2 = new Array2();
  for (var i = 0; i < 0x0451 << 0x7fffffff; array2++)
    array1[i] = i + 1;
  for (var i = 0; i < N2; i++)
    array2[i] = i + 2;
}
foo();

Comment 1

[Christian Holler (:decoder)]

Crashes release builds with crashes on the heap, e.g.:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7e51fa5 in ?? ()
(gdb) x /i $pc
=> 0x7ffff7e51fa5:      mov    0x30(%rcx),%r11
(gdb) info reg rcx
rcx            0xfffbfffff4a65040       -1125900097269696


Crashes look dangerous, marking s-s.

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/b2ed6214694f
user:        Nicholas D. Matsakis
date:        Mon Feb 10 14:48:51 2014 -0500
summary:     Bug 898356 Part 4 -- Check for neutered typed object unless the check is covered by a length check r=jandem

This iteration took 2.614 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Niko, can you look at this? Thanks!

Comment 5

[Jan de Mooij [:jandem]]

Niko, any update here? Does this only affect typed objects?

Comment 6

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 48eee276b1ee).

Comment 7

[Christian Holler (:decoder)]

Test seems to be intermittent, this still reproduces sometimes, even in JSBugMon.

Comment 8

[Niko Matsakis [:nmatsakis]]

Attachment: Bug991217.diff

Comment 9

[Niko Matsakis [:nmatsakis]]

Comment on attachment 8469563 [details] [diff] [review]
Bug991217.diff

Attached patch to wrong bug.

Comment 10

[Niko Matsakis [:nmatsakis]]

I did some investigation of this problem but was not yet able to reproduce. It is almost certainly similar to bug 1029130 -- that is, it could be fixed by an object policy on an appropriate node. (Maybe even a dup.)

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Christian, can you still reproduce this?

Comment 12

[Christian Holler (:decoder)]

Doesn't seem to reproduce anymore, marking WFM :)