921035 - Assertion failure: hasCallObj(), at ../jit/BaselineFrame-inl.h:73 or Crash [@ callObj]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision e85b0372cece (run with --fuzzing-safe --ion-eager):


function $ERROR() {}
function testMultipleArgumentsObjects() {
    var testargs = arguments;
    var f = function (which) {
        var args = [ testargs ];
        return args[which][0];
    };
    var arr = [0, 0, 0, 0, 1];
    for (var i = 0; i < arr.length; i++)
        $ERROR[i] = f(arr[i]);
}
testMultipleArgumentsObjects()

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/cd646a300ffe
user:        Kannan Vijayan
date:        Mon Sep 23 10:50:30 2013 -0400
summary:     Bug 918405 - Enable OSR-ing into Ion in functions with needsArgsObj. r=h4writer

This iteration took 400.086 seconds to run.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Kannan, is bug 918405 a likely regressor?

Comment 4

[Kyle Wooten]

Thanks!

Comment 5

[Kyle Wooten]

Thanks!

Comment 6

[Kyle Wooten]

Thanks!

Comment 7

[Aaron Train [:aaronmt]]

Please stop spamming bugs and cancelling flags.

Comment 8

[Kannan Vijayan [:djvj]]

(In reply to Gary Kwong [:gkw] [:nth10sd] (still catching up on bugmail) from comment #3)
> Kannan, is bug 918405 a likely regressor?

Yes.  There's a good chance it's a regressor.

Comment 9

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision ddd03c32fab1).

Comment 10

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/27921f21cddf
user:        Phil Ringnalda
date:        Mon Oct 14 14:03:03 2013 -0700
summary:     Back out 755ecb4d6e2c and 7ea09c8bf385 (bug 925962) for bustage

This iteration took 422.358 seconds to run.

Comment 11

[Kannan Vijayan [:djvj]]

I don't think bug 925962 is actually related to the issue.  I also think bug 918405 revealed the issue but is not the cause of it.

I haven't fully narrowed this down yet, but as far as I can tell, the function |testMultipleArgumentsObjects| is heavyweight, has a call object created for it when running in baseline, enters Ion via OSR (and the Call object is correctly carried into the Ion entry).. however, later there's a bailout from an inlined call to |f| within |testMultipleArgumentsObjects|, and when unpacking scopeChain objects from the snapshot in this bailout, the call object is not being captured.

Looking at the IonGraph spew for the function, during the Eliminate phis pass, the ResumePoint handle to the scope chain definition seems to be "lost" (refers to a nonexistant definition).

Comment 12

[Kannan Vijayan [:djvj]]

Yeah, aggressive phi elimination is getting rid of the scopeChain even though we may need it later to construct an arguments object.

Comment 13

[Kannan Vijayan [:djvj]]

Attachment: save-scope-chain.patch

Comment 14

[Hannes Verschore [:h4writer]]

Comment on attachment 817359 [details] [diff] [review]
save-scope-chain.patch

Review of attachment 817359 [details] [diff] [review]:
-----------------------------------------------------------------

Good find. Would be good to have an active testcase for this in jit-tests in order to not regress this.

Comment 15

[Kannan Vijayan [:djvj]]

Tried to create a testcase that asserted on tip for this yesterday, didn't get anywhere.  I'm checking in with the original test case, which is better than nothing.

Comment 16

[Phil Ringnalda (:philor)]

Turns out the original test case is worse than nothing, because it'll get you backed out in http://hg.mozilla.org/integration/mozilla-inbound/rev/062d17374196 by failing like https://tbpl.mozilla.org/php/getParsedLog.php?id=29195313&tree=Mozilla-Inbound ;)

Comment 17

[Kannan Vijayan [:djvj]]

Forgot that the correct outcome for that test case is for it to throw.  Will check in shortly.

Comment 18

[Kannan Vijayan [:djvj]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e41c12eedc22

Comment 19

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e41c12eedc22