1154185 - [gcc 5.0] Assertion failure: address.base() == HeapReg.code() and Assertion failure: e == end mochitest-1/jit-1 linux64 crashes

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Mike Hommey [:glandium]]

See: https://treeherder.mozilla.org/#/jobs?repo=try&revision=f5d5757faf4a
This try uses gcc 5.1.0-RC-20150412 (first RC release before 5.1, which, confusingly, will be the first release of GCC 5)

on opt builds: Assertion failure: address.base() == HeapReg.code(), at /builds/slave/try-l64-0000000000000000000000/build/src/js/src/asmjs/AsmJSSignalHandlers.cpp:610

on debug builds: Assertion failure: e == end, at /builds/slave/try-l64-d-00000000000000000000/build/src/js/src/jit/Disassembler.h:259

Comment 1

[Jan de Mooij [:jandem]]

Dan, any idea why this would fail with gcc 5.0? Maybe we can add some asserts/logging to help glandium debug this? :)

Comment 2

[Dan Gohman [:sunfish]]

Attachment: reduced testcase

Looks like it might be a compiler bug, possibly related to __attribute__((cold)). Attached is a somewhat reduced testcase which shows the bug. Reproduce with g++ -O2 *.cpp && ./a.out. With the gcc 5.0 snapshot, the assertion in main.cpp fails.

Comment 3

[Mike Hommey [:glandium]]

Filed GCC bug: 
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65765

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The GCC bug was fixed. Moreover, since then GCC 5.2 was released.