1204404 - Massive Assertion failure: isFinishedWithModulePrologue(), at /builds/slave/try-l64-d-00000000000000000000/build/src/js/src/asmjs/AsmJSModule.h:1122 when m-c merges to aurora September 21st

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Phil Ringnalda (:philor)]

The bulk of the debug orange in https://treeherder.mozilla.org/#/jobs?repo=try&revision=6a5c1cfcea73 (other than Jit and Android M12/M13) is from various flavors of

https://treeherder.mozilla.org/logviewer.html#?job_id=11374461&repo=try

8:10:21  WARNING -  TEST-UNEXPECTED-FAIL | tools/profiler/tests/test_asm.js | xpcshell return code: -11
18:10:21     INFO -  TEST-INFO took 556ms
18:10:21     INFO -  >>>>>>>
18:10:21     INFO -  PROCESS | 5163 | [5163] WARNING: Couldn't get the user appdata directory. Crash events may not be produced.: file /builds/slave/try-lx-d-000000000000000000000/build/src/toolkit/crashreporter/nsExceptionHandler.cpp, line 2320
18:10:21     INFO -  PROCESS | 5163 | Assertion failure: isFinishedWithModulePrologue(), at /builds/slave/try-lx-d-000000000000000000000/build/src/js/src/asmjs/AsmJSModule.h:1122
18:10:21     INFO -  <<<<<<<
18:10:35     INFO -  mozcrash Saved minidump as /builds/slave/test/build/blobber_upload_dir/63fbf5d7-a519-ab58-4054b848-584a7e01.dmp
18:10:35     INFO -  mozcrash Saved app info as /builds/slave/test/build/blobber_upload_dir/63fbf5d7-a519-ab58-4054b848-584a7e01.extra
18:10:35  WARNING -  PROCESS-CRASH | tools/profiler/tests/test_asm.js | application crashed [@ js::AsmJSModule::hasArrayView() const]
18:10:35     INFO -  Crash dump filename: /tmp/xpc-other-9ezChx/63fbf5d7-a519-ab58-4054b848-584a7e01.dmp
18:10:35     INFO -  Operating system: Linux
18:10:35     INFO -                    0.0.0 Linux 3.2.0-76-generic-pae #111-Ubuntu SMP Tue Jan 13 22:34:29 UTC 2015 i686
18:10:35     INFO -  CPU: x86
18:10:35     INFO -       GenuineIntel family 6 model 62 stepping 4
18:10:35     INFO -       1 CPU
18:10:35     INFO -  Crash reason:  SIGSEGV
18:10:35     INFO -  Crash address: 0x0
18:10:35     INFO -  Process uptime: not available
18:10:35     INFO -  Thread 0 (crashed)
18:10:35     INFO -   0  libxul.so!js::AsmJSModule::hasArrayView() const [AsmJSModule.h:6a5c1cfcea73 : 1122 + 0x18]
18:10:35     INFO -      eip = 0xb4d24824   esp = 0xbfc75030   ebp = 0xbfc75048   ebx = 0xb764ee84
18:10:35     INFO -      esi = 0xb0b50240   edi = 0xbfc769cc   eax = 0x00000000   ecx = 0xb18308ac
18:10:35     INFO -      edx = 0x00000000   efl = 0x00010282
18:10:35     INFO -      Found by: given as instruction pointer in context
18:10:35     INFO -   1  libxul.so!CheckModule [AsmJSValidate.cpp:6a5c1cfcea73 : 12422 + 0x25]
18:10:35     INFO -      eip = 0xb4dd3ae7   esp = 0xbfc75050   ebp = 0xbfc752d8   ebx = 0xb764ee84
18:10:35     INFO -      esi = 0xb0b50240   edi = 0xbfc769cc
18:10:35     INFO -      Found by: call frame info
18:10:35     INFO -   2  libxul.so!js::ValidateAsmJS(js::ExclusiveContext*, js::frontend::Parser<js::frontend::FullParseHandler>&, js::frontend::ParseNode*, bool*) [AsmJSValidate.cpp:6a5c1cfcea73 : 12470 + 0x5]
18:10:35     INFO -      eip = 0xb4dd98b3   esp = 0xbfc752e0   ebp = 0xbfc75368   ebx = 0xb764ee84
18:10:35     INFO -      esi = 0xb0b50240   edi = 0xbfc75328
18:10:35     INFO -      Found by: call frame info
18:10:35     INFO -   3  libxul.so!js::frontend::Parser<js::frontend::FullParseHandler>::asmJS(js::frontend::ParseNode*) [Parser.cpp:6a5c1cfcea73 : 2987 + 0x1d]
18:10:35     INFO -      eip = 0xb5462973   esp = 0xbfc75370   ebp = 0xbfc75398   ebx = 0xb764ee84
18:10:35     INFO -      esi = 0xbfc769cc   edi = 0xaec78840
18:10:35     INFO -      Found by: call frame info
...

Comment 1

[Luke Wagner [:luke]]

Attachment: fix-assert

I think this is a simple ordering issue between startFunctionBodies() and the assert containing hasArrayView().

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c817e82939c6

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c817e82939c6