1064668 - fix two asm.js profiling regressions

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

These came up profiling the SIMD demos.

Comment 1

[Luke Wagner [:luke]]

Attachment: fix-line-numbers

Function offsets need to eventually be stored in the AsmJSModule relative to the beginning of the module.  However, my earlier patch changed them to be module-relative too early and thus was feeding module-relative offsets into tokenStream.lineNum() which expects ScriptSource-relative offsets.

Comment 2

[Luke Wagner [:luke]]

Attachment: fix-asmjs-profiling

I think I suggested the "refactoring" that broke this.  The issue is that AsmJSActivation contains fields that were being initialized after the activation had been added to rt->profilingActivation_ and thus visible to asynchronous profiling.

Comment 3

[Luke Wagner [:luke]]

Attachment: combined.patch

Combined patch for Dan.

Comment 4

[Kannan Vijayan [:djvj]]

Comment on attachment 8486177 [details] [diff] [review]
fix-asmjs-profiling

Review of attachment 8486177 [details] [diff] [review]:
-----------------------------------------------------------------

Ah, such finnicky stuff :)

Comment 5

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8486176 [details] [diff] [review]
fix-line-numbers

Review of attachment 8486176 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch!

::: js/src/asmjs/AsmJSValidate.cpp
@@ -1018,5 @@
> -
> -            // The begin/end char range is relative to the beginning of the module.
> -            // hence the assertions.
> -            JS_ASSERT(fn->pn_pos.begin > m.srcStart());
> -            JS_ASSERT(fn->pn_pos.begin <= fn->pn_pos.end);

Could we keep these two assertions in AsmJSModule.h?

Comment 6

[Luke Wagner [:luke]]

(In reply to Benjamin Bouvier [:bbouvier] from comment #5)
> Could we keep these two assertions in AsmJSModule.h?

Yes, good point, I'll put them in AsmJSModule::addExportedFunction.

https://hg.mozilla.org/integration/mozilla-inbound/rev/5d9c1780c779
https://hg.mozilla.org/integration/mozilla-inbound/rev/526c183e9cd3

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/526c183e9cd3
https://hg.mozilla.org/mozilla-central/rev/5d9c1780c779

Comment 8

[Luke Wagner [:luke]]

Attachment: beta.patch

Approval Request Comment
[Feature/regressing bug #]:1057082
[User impact if declined]: crash while profiling asm.js code
[Describe test coverage new/current, TBPL]: m-c, m-a
[Risks and why]: quite low; this is a pretty simple fix to a simple bug; no rebasing required.

Comment 9

[Lawrence Mandel [:lmandel] (use needinfo)]

Comment on attachment 8506950 [details] [diff] [review]
beta.patch

Beta+

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/eb43a2c05eb3