Assertion failure: Modified registers between VM call and OsiPoint, at jit/IonMacroAssembler.cpp

RESOLVED FIXED in mozilla34

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: gkw, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, regression})

Trunk
mozilla34
x86_64
All
assertion, regression
Points:
---
Dependency tree / graph
Bug Flags:
qe-verify -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

3 years ago
This intermittent assertion has no reliable testcase and last occurred for me on https://hg.mozilla.org/mozilla-central/rev/391f42c733fc - it has been occurring since many months ago.

Jan thinks he has discovered the cause.
Flags: needinfo?(jdemooij)
(Reporter)

Comment 1

3 years ago
Created attachment 8472584 [details]
stack

Example stack off m-c rev 9fdb8047f07d on Linux.
Excellent. I'm hitting this as well sometimes, never got a reproducible test :(
Blocks: 676763
(Assignee)

Comment 4

3 years ago
Created attachment 8472931 [details] [diff] [review]
Patch

The problem is a (debug only) race with off-thread compilation:

(1) Off-thread Ion compilation does not emit code to dump the registers because checkOsiPointRegisters = false
(2) Main thread calls enableOsiPointRegisterChecks() and sets JitOptions.checkOsiPointRegisters = true
(3) Off-thread code generator emits code to verify the registers, but because of (1), this will always fail.

That's why this is so hard to reproduce and required off-thread compilation.

This patch just stores the value in the CodeGenerator, so that we will always emit both the dump + verify code. We could also cancel all off-thread compilations in enableOsiPointRegisterChecks(), but that only works for the current runtime. In the shell there's usually only 1 runtime, but this function can also be called in the browser.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Attachment #8472931 - Flags: review?(nicolas.b.pierron)
Flags: needinfo?(jdemooij)
Comment on attachment 8472931 [details] [diff] [review]
Patch

Review of attachment 8472931 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/shared/CodeGenerator-shared.cpp
@@ +60,5 @@
>      sps_(&GetIonContext()->runtime->spsProfiler(), &lastNotInlinedPC_),
>      osrEntryOffset_(0),
>      skipArgCheckEntryOffset_(0),
> +#ifdef CHECK_OSIPOINT_REGISTERS
> +    checkOsiPointRegisters(js_JitOptions.checkOsiPointRegisters),

Do we have races reported by TSan on this issue?
Shouldn't we do something similar to JitCompilerOptions for all jitOptions?
Attachment #8472931 - Flags: review?(nicolas.b.pierron) → review+
(Assignee)

Comment 6

3 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/d0470d965f46

(In reply to Nicolas B. Pierron [:nbp] {N/A 22-29/08} from comment #5)
> Do we have races reported by TSan on this issue?

Good question; I don't know if TSan reported this.

> Shouldn't we do something similar to JitCompilerOptions for all jitOptions?

Yeah if we find other races it may be a good idea to refactor js_JitOptions and make a copy for the background thread...
https://hg.mozilla.org/mozilla-central/rev/d0470d965f46
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
Flags: qe-verify-
You need to log in before you can comment on or make changes to this bug.