1058024 - IonMonkey: (ARM) Assertion failure when running jsapi-tests for arm-simulator

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Branislav Rankov [:rankov]]

Here is the message. 

testJitMoveEmitterCycles_autogen3
Assertion failure: cx->runtime()->currentThreadOwnsInterruptLock(), at /scratch/work/github-gecko/gecko-dev/js/src/jsapi-tests/../jit/IonLinker.h:87
Segmentation fault (core dumped)

Also I suspect that jsapi-test are not run on tbpl. I can't find them in the log. I've looked at SM(ARM)

Comment 1

[Douglas Crosher [:dougc]]

fwiw the use of AutoFlushICache also looks wrong in testJitMoveEmitterCycles.cpp. The AutoFlushICache should be in a lexical context that ends just after newCodeForIonScript(), so that the simulator icache is flushed before executing the code, rather than at the end of the function as-is.

Comment 2

[Branislav Rankov [:rankov]]

Attachment: Fix-testJitMoveEmitterCycles-arm.patch

First problem was that call to rt->getJitRuntime(cx) was removed by previous patch.
I also fixed the problem Doug found by adding linkAndAllocate()
I also had to change all uses of CHECK macro.

Comment 3

[Marty Rosenberg [:mjrosenb]]

Comment on attachment 8482721 [details] [diff] [review]
Fix-testJitMoveEmitterCycles-arm.patch

Review of attachment 8482721 [details] [diff] [review]:
-----------------------------------------------------------------

How did this ever work with the comparison reversed?  I'm at least 20% sure that I tested this before I committed it.

Comment 4

[Branislav Rankov [:rankov]]

https://tbpl.mozilla.org/?tree=Try&rev=1e102a32ee69

Comment 5

[Branislav Rankov [:rankov]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8e746619502b

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8e746619502b

Comment 8

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8482721 [details] [diff] [review]
Fix-testJitMoveEmitterCycles-arm.patch

Approval Request Comment
[Feature/regressing bug #]: dunno
[User impact if declined]: we will be unable to run jsapi-tests on beta because failures will be masked by this test and we will accidentally introduce a critical bug resulting in the complete destruction of Firefox's reputation and the Web will turn away from open solutions and stagnate again, preventing the creation of better worldwide communication mechanisms that turn out to be critical once we discover the giant asteroid heading for Earth and we will be unable to coordinate our response effectively enough to prevent it from hitting us and destroying all life and knocking out a second moon that will turn out to be shaped rather like an unattractive peanut
[Describe test coverage new/current, TBPL]: N/A, this *is* a test. But I think the patch has been on m-c for a while.
[Risks and why]: None, this patch only modifies a test
[String/UUID change made/needed]: none

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8482721 [details] [diff] [review]
Fix-testJitMoveEmitterCycles-arm.patch

Test only, taking.
BTW: https://twitter.com/MozillaReleases/status/515393074235990016 ;)
Thanks for the fun.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d79790b0fdbf
https://hg.mozilla.org/releases/mozilla-beta/rev/371e802df4dc