1319232 - Assertion failure: cmpret == 0, at js/src/jit/arm/Simulator-arm.cpp:1085

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 0534254e9a40 (build with --enable-debug --enable-more-deterministic --32 --enable-simulator=arm, run with --fuzzing-safe --no-threads --ion-eager --arm-sim-icache-checks --no-asmjs):

// Adapted from randomly chosen test: js/src/jit-test/tests/asm.js/testTimeout4.js
var f = Function("\
    function g() {\
        while (true) {};\
    }\
    return g;\
").apply();
timeout(1);
f();


Backtrace:

0   js-dbg-32-dm-clang-armSim-darwin-0534254e9a40	0x004fed16 js::jit::Simulator::checkICacheLocked(js::HashMap<void*, js::jit::CachePage*, js::jit::Simulator::ICacheHasher, js::SystemAllocPolicy>&, js::jit::SimInstruction*) + 326 (Simulator-arm.cpp:1085)
1   js-dbg-32-dm-clang-armSim-darwin-0534254e9a40	0x004fe887 js::jit::Simulator::instructionDecode(js::jit::SimInstruction*) + 151 (Simulator-arm.cpp:379)
2   js-dbg-32-dm-clang-armSim-darwin-0534254e9a40	0x0050783a void js::jit::Simulator::execute<false>() + 138 (Simulator-arm.cpp:4753)
3   js-dbg-32-dm-clang-armSim-darwin-0534254e9a40	0x00507111 js::jit::Simulator::callInternal(unsigned char*) + 225 (Simulator-arm.cpp:4842)
4   js-dbg-32-dm-clang-armSim-darwin-0534254e9a40	0x00507a2b js::jit::Simulator::call(unsigned char*, int, ...) + 283 (Simulator-arm.cpp:4926)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/39a7161b9628
user:        Sean Stangl
date:        Fri Nov 18 14:29:00 2016 -0500
summary:     Bug 1285074 - Make ICacheMap manipulation signal-safe. r=luke

Sean, is bug 1285074 a likely regressor?

Comment 3

[Sean Stangl [:sstangl]]

Attachment: 0001-Bug-1319232-Correctly-set-cacheInvalidatedBySignalHa.patch

The atomic was never toggled.

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 8812931 [details] [diff] [review]
0001-Bug-1319232-Correctly-set-cacheInvalidatedBySignalHa.patch

Review of attachment 8812931 [details] [diff] [review]:
-----------------------------------------------------------------

oops

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/eb9fb9a30fd9
Correctly set cacheInvalidatedBySignalHandler_. r=luke

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/eb9fb9a30fd9