Closed Bug 1019322 Opened 6 years ago Closed 6 years ago

Assertion failure: !IsCompilingAsmJS(), at jit/shared/Assembler-shared.h

Categories

(Core :: JavaScript Engine: JIT, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla32

People

(Reporter: gkw, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker] [jsbugmon:])

Attachments

(2 files)

Attached file stack
(function() {
   "use asm";
   function f() {}
})()


asserts js debug shell on m-c changeset 99137ca57770 with -D --no-ion at Assertion failure: !IsCompilingAsmJS(), at jit/shared/Assembler-shared.h

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>


=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140602081507" and the hash "bff5585f1b9b".
The "bad" changeset has the timestamp "20140602083607" and the hash "1c9fed1fd66c".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=bff5585f1b9b&tochange=1c9fed1fd66c

Brian, is bug 1018290 a likely regressor?

(Due to the simplicity of the testcase, this completely broke fuzzing asm.js with -D. Also setting fuzzblocker.)
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
asm.js compilation prohibits the use of pointer immediates in generated code, which script profiling uses to accumulate basic block hit counts.  I think this restriction is so that asm.js code can be serialized/deserialized, so this patch just avoids serializing modules with profiling information and allows the use of immediates when profiling during asm.js compilation.
Attachment #8433473 - Flags: review?(luke)
Flags: needinfo?(bhackett1024)
Comment on attachment 8433473 [details] [diff] [review]
patch

Review of attachment 8433473 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/AsmJSModule.cpp
@@ +1267,5 @@
>                              const AsmJSModule &module,
>                              ExclusiveContext *cx)
>  {
> +    // Don't serialize modules with profiling information compiled in.
> +    if (module.numFunctionCounts())

Can you append "PC count" to "profiling information" and then append the sentence: "(This is separate than normal profiling and requires an add-on to activate.)"
Attachment #8433473 - Flags: review?(luke) → review+
Whiteboard: [fuzzblocker][jsbugmon:update] → [fuzzblocker] [jsbugmon:]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
https://hg.mozilla.org/mozilla-central/rev/b144d655a179
Assignee: nobody → bhackett1024
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
This seems to have regressed abunch of awfy microbenchmarks. I'm not sure we care, just leaving a note.
I couldn't find what you're referring to, but anyhow it seems pretty unlikely this patch is at fault as there is only 1 non-DEBUG line in this patch and it is only on the caching path, which isn't exercised by awfy microbenchmarks.
You need to log in before you can comment on or make changes to this bug.