1145997 - Intermittent TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/debug/Memory-onGarbageCollection-01.js | Assertion failure: T(double(t)) == t (value creation would be lossy), at ../../dist/include/js/Value.h:1596 (code -11, args "--no-baseline --no-ion")

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Jim Blandy :jimb]

I have seen these failures in Try pushes for bug 1134039, but now they've gone away and I get clean try pushes.

I'm filing this bug so that I can be notified if they were not actually resolved, and to allow others to just star the failure and move on with their lives. If it doesn't come up any more, I'll close the bug.

Comment 1

[Jon Coppeard (:jonco)]

I think the problem is that Debugger::translateGCStatistics() makes use of the runtime's GC statistics object but can also trigger a GC which will mutate that object.

Comment 2

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=8244536
repository: mozilla-inbound
start_time: 2015-03-30T11:35:16
who: rvandermeulen[at]mozilla[dot]com
machine: bld-linux64-spot-056
buildname: Linux x86-64 mozilla-inbound leak test spidermonkey_tier_1-compacting build
revision: 7dc91f45e235

Assertion failure: T(double(t)) == t (value creation would be lossy), at ../../dist/include/js/Value.h:1593
TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/gc/bug-1146696.js | Assertion failure: T(double(t)) == t (value creation would be lossy), at ../../dist/include/js/Value.h:1593 (code -11, args "--no-ggc")
INFO stderr         2> Assertion failure: T(double(t)) == t (value creation would be lossy), at ../../dist/include/js/Value.h:1593
make[1]: *** [check-jit-test] Error 2
make: *** [check-jit-test] Error 2

Comment 3

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=mozilla-inbound&job_id=8247445
repository: mozilla-inbound
start_time: 2015-03-30T12:38:33
who: wkocher[at]mozilla[dot]com
machine: bld-linux64-spot-125
buildname: Linux x86-64 mozilla-inbound leak test spidermonkey_tier_1-compacting build
revision: 7dc91f45e235

Assertion failure: T(double(t)) == t (value creation would be lossy), at ../../dist/include/js/Value.h:1593
TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/gc/bug-1146696.js | Assertion failure: T(double(t)) == t (value creation would be lossy), at ../../dist/include/js/Value.h:1593 (code -11, args "--no-ggc")
INFO stderr         2> Assertion failure: T(double(t)) == t (value creation would be lossy), at ../../dist/include/js/Value.h:1593
make[1]: *** [check-jit-test] Error 2
make: *** [check-jit-test] Error 2

Comment 4

[Jon Coppeard (:jonco)]

Attachment: bug1145997-suppress-gc

Since this is happening fairly often I think we should fix this the easy way first: by suppressing GC in Debugger::translateGCStatistics().

I think a better fix would be to separate out the Statistics object into an object that holds the statistics and the object that produces them.  We can allocate a new data object at the start of GC and then detach it from the producer and pass it to Debugger::onGarbageCollection() in endGC() before deleting it.  As long as the stats object is not held in some global location when the debugger hook runs this situation will not arise.

Comment 5

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8586161 [details] [diff] [review]
bug1145997-suppress-gc

Review of attachment 8586161 [details] [diff] [review]:
-----------------------------------------------------------------

This seems fine for a spot fix for the intermittent orange. I agree with the longer term direction too, though it gets a little weird because each GC slice gets a new fallible allocation. But that's no worse than what we're doing already, with the 'aborted' flag.

Comment 6

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/51b6fe554629

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/51b6fe554629

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/9ed6bab11259

Comment 9

[BMO Automation]

Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:sdetar, maybe it's time to close this bug?

Comment 11

[Steven DeTar [:sdetar]]

Jon, what should do with this old bug which has leave-open keyword?

Comment 12

[Jon Coppeard (:jonco)]

This is fixed now.