1033146 - Win64 testGCHeapPostBarriers | CHECK failed: heapData->get() == nullptr

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[(Away)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=42829541&tree=Date&full=1

http://dxr.mozilla.org/mozilla-central/source/js/src/jsapi-tests/testGCHeapPostBarriers.cpp#30

This is some kind of compile issue on Win64. In the disassembly I see the test for CHECK(heapData) but there is no test for CHECK(heapData->get() == nullptr). The code just assumes that the test fails, so we do the error sequence and return. The rest of the function, like the MinorGC, isn't even present.

If I do something like this, then the test passes:
__declspec(noinline) bool Dummy(bool x) { return x; }
CHECK(Dummy(heapData->get() == nullptr));

Should we just paper over this?

Comment 1

[Terrence Cole [:terrence]]

That is horrifying and rather implies that we are probably being similarly miscompiled elsewhere on win64. I'd much prefer we try to find out what undefined behavior is triggering this particular "optimization" on MSVC's part. Does ubisan find anything in this file?

Comment 2

[(Away)]

No complaints from ubsan on linux64.

Comment 3

[Terrence Cole [:terrence]]

Also, what compiler is this and is it PGO only?

I guess we'll need to paper over it, so go ahead and prep a patch.

Comment 4

[(Away)]

It's Visual Studio 2010, non-PGO. I don't know whether PGO builds are affected; AFAICT we don't PGO Win64 builds.

It appears to be fixed in Visual Studio 2012. Haven't tested 2013.

Comment 5

[(Away)]

Attachment: Paper over

Comment 6

[Terrence Cole [:terrence]]

Comment on attachment 8450728 [details] [diff] [review]
Paper over

Review of attachment 8450728 [details] [diff] [review]:
-----------------------------------------------------------------

r=me

Comment 7

[(Away)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9dc87050ee0a

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9dc87050ee0a