1136551 - Crash at a weird memory address or Assertion failure: *def->output() != alloc, at jit/RegisterAllocator.cpp or Assertion failure: *def->output() == alloc, at jit/RegisterAllocator.cpp

Status: RESOLVED DUPLICATE of bug 1136898

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

f = function(stdlib, n, heap) {
    "use asm";
    var Int8ArrayView = new stdlib.Int8Array(heap);
    function f() {
        Int8ArrayView[9999 >> 0] = 0
    }
}

asserts js debug 32-bit shell on m-c changeset 0a8b3b67715a with --fuzzing-safe --no-threads --ion-eager --ion-regalloc=lsra at Assertion failure: *def->output() != alloc, at jit/RegisterAllocator.cpp.

Configure options:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh ~/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build --32 -R ~/trees/mozilla-central" -r 0a8b3b67715a

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/11a0fa1a0122
user:        Dan Gohman
date:        Tue Feb 24 07:50:14 2015 -0800
summary:     Bug 986981 - OdinMonkey: Optimize addresses with constant offsets on x86 and x64 r=luke

Dan, is bug 986981 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x279e49, 0x0066c7de js-dbg-32-dm-nsprBuild-darwin-0a8b3b67715a`js::jit::AllocationIntegrityState::checkIntegrity(this=<unavailable>, block=<unavailable>, ins=<unavailable>, vreg=<unavailable>, alloc=(bits_ = 11), populateSafepoints=<unavailable>) + 1102 at RegisterAllocator.cpp:217, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0066c7de js-dbg-32-dm-nsprBuild-darwin-0a8b3b67715a`js::jit::AllocationIntegrityState::checkIntegrity(this=<unavailable>, block=<unavailable>, ins=<unavailable>, vreg=<unavailable>, alloc=(bits_ = 11), populateSafepoints=<unavailable>) + 1102 at RegisterAllocator.cpp:217
    frame #1: 0x0066a974 js-dbg-32-dm-nsprBuild-darwin-0a8b3b67715a`js::jit::AllocationIntegrityState::check(this=<unavailable>, populateSafepoints=<unavailable>) + 1012 at RegisterAllocator.cpp:168
    frame #2: 0x0051a725 js-dbg-32-dm-nsprBuild-darwin-0a8b3b67715a`js::jit::GenerateLIR(mir=0x00000000) + 1957 at Ion.cpp:1492
    frame #3: 0x000b3119 js-dbg-32-dm-nsprBuild-darwin-0a8b3b67715a`CheckModule(js::ExclusiveContext*, js::frontend::Parser<js::frontend::FullParseHandler>&, js::frontend::ParseNode*, js::ScopedJSDeletePtr<js::AsmJSModule>*, js::ScopedJSFreePtr<char>*) [inlined] CheckFunctionsSequential(m=0x01e012f0)::ModuleCompiler&) + 463 at AsmJSValidate.cpp:7720
    frame #4: 0x000b2f4a js-dbg-32-dm-nsprBuild-darwin-0a8b3b67715a`CheckModule(js::ExclusiveContext*, js::frontend::Parser<js::frontend::FullParseHandler>&, js::frontend::ParseNode*, js::ScopedJSDeletePtr<js::AsmJSModule>*, js::ScopedJSFreePtr<char>*) [inlined] CheckFunctions(m=0x01e012f0)::ModuleCompiler&) at AsmJSValidate.cpp:7966
(lldb)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function(stdlib, n, heap) {
    "use asm"
    var Uint8ArrayView = new stdlib.Uint8Array(heap)
    function f() {
        Uint8ArrayView[(735083223 + 1544918759) >>> 155] = 67301701
    }
    return f
})(this, {}, new ArrayBuffer(4096))()

crashes js opt 32-bit shell with --fuzzing-safe --no-threads --ion-eager --ion-regalloc=lsra at a weird memory address and asserts similarly.

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh ~/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --disable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--disable-debug --enable-more-deterministic --enable-nspr-build --32 -R ~/trees/mozilla-central" -r 0a8b3b67715a

Process 64513 stopped
* thread #1: tid = 0x331e3c, 0x014fe027, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x80bf745)
    frame #0: 0x014fe027
-> 0x14fe027:  movb   %al, 0x4090600(%eax)
   0x14fe02d:  nop
   0x14fe02f:  addl   $0x4, %esp
   0x14fe032:  retl
(lldb)

Comment 3

[Dan Gohman [:sunfish]]

I propose to fix this by implementing bug 1136898.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

f = function(stdlib, n, heap) {
    "use asm"
    var Uint8ArrayView = new stdlib.Uint8Array(heap)
    function f() {
        Uint8ArrayView[9999 >> 0] = 0 >> Uint8ArrayView[0] > 0
    }
}

asserts js debug 32-bit shell on m-c changeset 0a8b3b67715a with --fuzzing-safe --no-threads --ion-eager --ion-regalloc=lsra at Assertion failure: *def->output() == alloc, at jit/RegisterAllocator.cpp.

Configure options:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh ~/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build --32 -R ~/trees/mozilla-central" -r 0a8b3b67715a

This bisects to the same bug, guessing this is the same issue.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 7

[Dan Gohman [:sunfish]]

Now that bug 1136898 is fixed, this bug no longer exists.