1100237 - Assertion failure: memcmp(reinterpret_cast<void*>(instr), cache_page->cachedData(offset), SimInstruction::kInstrSize) == 0, at jit/arm/Simulator-arm.cpp

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

// Random chosen test: js/src/jit-test/tests/asm.js/testResize.js
function asmCompile() {
    var f = Function.apply(null, arguments)
    return f
}
function asmLink(f) {
    ret = f.apply(null, Array.slice(arguments, 1))
    return ret
}
byteLength = Function.prototype.call.bind(
    Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength").get
);
body = "\
    \"use asm\";\
    var I32 = glob.Int32Array;\
    var i32 = new I32(b);\
    var len = glob.byteLength;\
    function ch(b2) {\
        if (len(b2) & 0xffffff || len(b2) <= 0xffffff || len(b2) > 80000000) {\
            return false;\
        }\
        i32 = new I32(b2);\
        b = b2;\
        return true\
    }\
    function get(i) {\
        i = i | 0;\
        return i32[i >> 2] | 0\
    }\
    return {\
        get: get,\
        changeHeap: ch\
    }\
"
m = asmCompile("glob", "s", "b", body)
buf1 = ArrayBuffer(16777216)
var {
    get, changeHeap
} = asmLink(m, this, null, buf1)
assertEq(changeHeap(ArrayBuffer(33554432)), true)
assertEq(get(), 0)
changeHeap(buf1)(get())

asserts js debug shell on m-c changeset a52bf59965a0 with --fuzzing-safe --ion-eager --no-threads --arm-sim-icache-checks at Assertion failure: memcmp(reinterpret_cast<void*>(instr), cache_page->cachedData(offset), SimInstruction::kInstrSize) == 0, at jit/arm/Simulator-arm.cpp.

Debug configure options:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-arm-simulator --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

This was found by combining random jit-tests together with jsfunfuzz. The specific file, which was run with random flag combinations, is:

http://hg.mozilla.org/mozilla-central/file/a52bf59965a0/js/src/jit-test/tests/asm.js/testResize.js

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8d4702c0db51
user:        Luke Wagner
date:        Wed Oct 15 09:09:44 2014 -0500
summary:     Bug 1082107 - OdinMonkey: add maximum-length requirement to change-heap definition (r=bbouvier)

Luke, is bug 1082107 a likely regressor?

Setting s-s and sec-critical because a previous bug 1055034 with a similar assert was marked s-s and sec-critical.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x50bb15, 0x00493c58 js-dbg-opt-32-dm-nsprBuild-armSim-darwin-a52bf59965a0`js::jit::Simulator::instructionDecode(js::jit::SimInstruction*) [inlined] js::jit::AutoLockSimulatorRuntime::AutoLockSimulatorRuntime(srt=<unavailable>) + 15 at Simulator-arm.cpp:419, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00493c58 js-dbg-opt-32-dm-nsprBuild-armSim-darwin-a52bf59965a0`js::jit::Simulator::instructionDecode(js::jit::SimInstruction*) [inlined] js::jit::AutoLockSimulatorRuntime::AutoLockSimulatorRuntime(srt=<unavailable>) + 15 at Simulator-arm.cpp:419
    frame #1: 0x00493c49 js-dbg-opt-32-dm-nsprBuild-armSim-darwin-a52bf59965a0`js::jit::Simulator::instructionDecode(js::jit::SimInstruction*) [inlined] js::jit::AutoLockSimulatorRuntime::AutoLockSimulatorRuntime(srt=<unavailable>) at Simulator-arm.cpp:423
    frame #2: 0x00493c49 js-dbg-opt-32-dm-nsprBuild-armSim-darwin-a52bf59965a0`js::jit::Simulator::instructionDecode(this=<unavailable>, instr=<unavailable>) + 1273 at Simulator-arm.cpp:4131
    frame #3: 0x004ac38a js-dbg-opt-32-dm-nsprBuild-armSim-darwin-a52bf59965a0`void js::jit::Simulator::execute<false>(this=0x0280a600) + 138 at Simulator-arm.cpp:4215
    frame #4: 0x0049b4b7 js-dbg-opt-32-dm-nsprBuild-armSim-darwin-a52bf59965a0`js::jit::Simulator::callInternal(this=0x0280a600, entry=0x019dd000) + 231 at Simulator-arm.cpp:4303
(lldb)

Comment 2

[Luke Wagner [:luke]]

Attachment: add-missing-icache-flush

Missing AutoICacheFlush around the change-heap patching.

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

Adding rating per comment 0.

Comment 4

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4f1382061059

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/4f1382061059

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.