1353681 - Crash [@ js::jit::Simulator::decodeType01] or Assertion failure: !cycleEnd_, at jit/MoveResolver.h:278

Status: RESOLVED DUPLICATE of bug 1299147

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 7a3f514cf849 (build with --32 --enable-more-deterministic --enable-simulator=arm, run with --fuzzing-safe --no-threads --ion-eager --ion-gvn=off --ion-check-range-analysis):

function f1(f, inputs) {
    var x = [];
    for (var j = 0; j < 2; ++j) {
        for (var k = 0; k < 1; ++k) {
            try {
                x.push(f(inputs[j], inputs[k]));
            } catch (e) {}
        }
    }
}
function f2(x) {
    Math.fround(-Math.fround(Math.fround()))
    Math.min(undefined) ? (Math.tan, Math.tan | 0 | 0) :
        +(Math.fround(0) > Math.fround() > -Infinity)
}
f1(f2, [Infinity]);
f1(f2, [Infinity, 0]);


Backtrace:

#0  js::jit::Simulator::decodeType01 (this=0xf7123000, instr=0x247eb08c) at js/src/jit/arm/Simulator-arm.cpp:3185
#1  0x083dc20a in js::jit::Simulator::instructionDecode (this=0xf7123000, instr=0x247eb08c) at js/src/jit/arm/Simulator-arm.cpp:4687
#2  0x083dc76a in js::jit::Simulator::execute<false> (this=0xf7123000) at js/src/jit/arm/Simulator-arm.cpp:4760
#3  js::jit::Simulator::callInternal (this=0xf7123000, entry=0x247c87b8 "\360O-\351\004\320M\342\020\212-\355\r\200\240\341h\220\235\345t\240\235", <incomplete sequence \345>) at js/src/jit/arm/Simulator-arm.cpp:4848
#4  0x083dca2c in js::jit::Simulator::call (this=0xf7123000, entry=0x247c87b8 "\360O-\351\004\320M\342\020\212-\355\r\200\240\341h\220\235\345t\240\235", <incomplete sequence \345>, argument_count=<optimized out>) at js/src/jit/arm/Simulator-arm.cpp:4931
/snip

For detailed crash information, see attachment.

Build configuration:
CXX="g++ -m32 -msse2 -mfpmath=sse" CC="gcc -m32 -msse2 -mfpmath=sse" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig sh ./configure --target=i686-pc-linux --enable-simulator=arm --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This seems to differ from bug 1299147 even though the assert (and stack) seems similar, this one crashes opt shell whereas that one does not.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b7adf3986079
user:        Sander Mathijs van Veen
date:        Tue Feb 07 07:18:00 2017 +0100
summary:     Bug 1337367 - Postpone spilling bundles till after regalloc main loop r=bhackett

Sander, is bug 1337367 a likely regressor?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I discovered I may have filed some related dupe(?) bugs previously, e.g. bug 1337967, but this seems to be the first one which crashes opt builds as well.

Moving needinfo? to Jan/Hannes. It will be nice to have this fixed.

Comment 5

[Jan de Mooij [:jandem]]

Hannes weren't you working on this signature a while ago? Either that or I'm confusing it with another bug..

Comment 6

[Hannes Verschore [:h4writer]]

Sigh, this is a real bug.

Movements are:
...
s7 -> s0
s6 -> s1
...
d0 -> d3

Move resolver sees:
d0 -> d3: blocks s7 -> s0
 => s7 -> s0: start cycle 0
 => d0 -> d3: stop cycle 0
s7 -> s0: accepted
d0 -> d3: blocks s6 -> s1
 => s6 -> s1: start cycle 1
 => d0 -> d3: stop cycle 1 (NOTE: here we assert, since we can only have one cycle)
s6 -> s1: accepted
d0 -> d3: accepted

Move emitter sees:
s7 -> s0
  save s0,s0 on stack:0
s6 -> s1
  save s1,s1 on stack:16
d0 -> d3
  save stack:16 in d3

i.e. we save s1,s1 in d3 instead of s0,s1

Comment 7

[Hannes Verschore [:h4writer]]

Ignore previous comment. We do save d0. We go wrong somewhere else. Further investigating.

Comment 8

[Hannes Verschore [:h4writer]]

This is most likely a range analysis bug.

I manually looked at the two places where the "move resolver" came into trouble. I looked at the generated code and like I noticed in bug 1299147, this actually outputs correct code. In this case too.

When removing the "cycle" asserts in a debug release I get an extra clue:
Assertion failure: Double input should be lower or equal than Upperbound., at /home/h4writer/Build/mozilla-inbound/js/src/jit/MacroAssembler.cpp:1654

This bug is a range analysis bug and not a "move resolver" bug.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

If you can give me a testcase or a patch that causes that Double input assert, I can try to bisect as well.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Likely range analysis bug + Hannes is unlikely to be working on this in the future, so redirecting needinfo? to Jan.

Comment 11

[Sean Stangl [:sstangl]]

Needs re-testing now that Bug 1299147 landed. If that didn't fix it, I'll take a look.

Comment 12

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   358107:8178250f3a8b
user:        Sean Stangl
date:        Thu May 04 15:39:52 2017 -0700
summary:     Bug 1299147 - Split double MoveOperands that conflict with floats. r=jandem

I verify using autobisect that this is indeed FIXED by bug 1299147.

Comment 13

[Sean Stangl [:sstangl]]

Great!