1292664 - Intermittent browser_perf-recording-selected-03.js | application crashed [@ js::jit::JitcodeGlobalTable::lookupForSamplerInfallible(void *,JSRuntime *,unsigned int)] after Assertion failure: entry->isMarkedFromAnyThread(rt)

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Treeherder Bug Filer]

Filed by: wkocher [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=10996853&repo=fx-team

http://archive.mozilla.org/pub/firefox/tinderbox-builds/fx-team-win32-debug/1470404541/fx-team_win7_vm-debug_test-mochitest-devtools-chrome-4-bm140-tests1-windows-build22.txt.gz

Comment 1

[Jon Coppeard (:jonco)]

Attachment: bug1292664-jitcode-table-assert

This is an assertion failure in JitcodeGlobalTable::lookupForSamplerInfallible on the sampler thread.  The main thread is suspended while in the process of resetting an incremental GC and was sweeping.

Apart from the fact that this whole setup seems inherently risky, the assertion doesn't take account of zone GCs or resets.  What probably happened is that a full GC cleared the mark bits for the zone in question but a reset cancelled the sweeping of the zone so the table entries were not marked.

Comment 2

[Terrence Cole [:terrence]]

Comment on attachment 8778837 [details] [diff] [review]
bug1292664-jitcode-table-assert

Review of attachment 8778837 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, this code is insanity. ISTR that that assertion went through a bunch of different variations and I think one of them was just checking the zone's sweep status? Anyway, let's find out!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5d5d3ef04f3f
Improve GC state assertion in JitcodeGlobalTable r=terrence

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5d5d3ef04f3f