1415360 - SpiderMonkey 52 tests fail on s390x architecture

Status: RESOLVED INACTIVE

(Core :: JavaScript Engine, defect, P5)

Description

[Charles Robertson]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20171004114729

Steps to reproduce:

1) Build SpiderMonkey.
2) Run jstests.py:
    # cd js/src
    # tests/jstests.py -d -s -t 1800 --no-progress ../../js/src/js/src/shell/js


Actual results:

The following tests fail:

js/src/tests/ecma_6/ArrayBuffer/CloneArrayBuffer.js
js/src/tests/ecma_6/TypedArray/subarray.js
js/src/tests/ecma_6/TypedArray/Tconstructor-fromTypedArray-byteLength.js
js/src/tests/ecma_6/TypedArray/set-same-buffer-different-source-target-types.js
js/src/tests/js1_8_5/extensions/clone-transferables.js:

Logged results:
================================================
js/src/tests/js1_8_5/extensions/clone-transferables.js:
[  832s] ## js1_8_5/extensions/clone-transferables.js: rc = 3, run time = 0.394776
[  832s] /home/abuild/rpmbuild/BUILD/mozilla/js/src/js/src/shell/js -f shell.js -f js1_8_5/shell.js -f js1_8_5/extensions/shell.js -f js1_8_5/extensions/clone-transferables.js
[  832s] js1_8_5/extensions/clone-transferables.js:42:17 Error: Assertion failed: got 0, expected NaN
[  832s] Stack:
[  832s]   test@js1_8_5/extensions/clone-transferables.js:42:17
[  832s]   @js1_8_5/extensions/clone-transferables.js:111:1
[  832s] REGRESSION - js1_8_5/extensions/clone-transferables.js
...
js/src/tests/ecma_6/TypedArray/set-same-buffer-different-source-target-types.js
[  852s] ## ecma_6/TypedArray/set-same-buffer-different-source-target-types.js: rc = 3, run time = 0.42572
[  852s] /home/abuild/rpmbuild/BUILD/mozilla/js/src/js/src/shell/js -f shell.js -f ecma_6/shell.js -f ecma_6/TypedArray/shell.js -f ecma_6/TypedArray/set-same-buffer-different-source-target-types.js
[  852s] 896116: When setting a typed array from an overlapping typed array of different element type, copy the source elements into properly-sized temporary memory, and properly copy them into the target without overflow (of either source *or* target) when finished
[  852s] ecma_6/TypedArray/set-same-buffer-different-source-target-types.js:27:11 RangeError: attempting to construct out-of-bounds TypedArray on ArrayBuffer
[  852s] Stack:
[  852s]   @ecma_6/TypedArray/set-same-buffer-different-source-target-types.js:27:11
...
js/src/tests/ecma_6/TypedArray/Tconstructor-fromTypedArray-byteLength.js
[  852s] ## ecma_6/TypedArray/Tconstructor-fromTypedArray-byteLength.js: rc = 3, run time = 0.279539
[  852s] /home/abuild/rpmbuild/BUILD/mozilla/js/src/js/src/shell/js -f shell.js -f ecma_6/shell.js -f ecma_6/TypedArray/shell.js -f ecma_6/TypedArray/Tconstructor-fromTypedArray-byteLength.js
[  852s] ecma_6/TypedArray/Tconstructor-fromTypedArray-byteLength.js:8:9 Error: Assertion failed: got 3, expected 0
[  852s] Stack:
[  852s]   @ecma_6/TypedArray/Tconstructor-fromTypedArray-byteLength.js:8:9
[  852s] REGRESSION - ecma_6/TypedArray/Tconstructor-fromTypedArray-byteLength.js
...
js/src/tests/ecma_6/TypedArray/subarray.js
[  853s] ## ecma_6/TypedArray/subarray.js: rc = 3, run time = 0.61169
[  853s] /home/abuild/rpmbuild/BUILD/mozilla/js/src/js/src/shell/js -f shell.js -f ecma_6/shell.js -f ecma_6/TypedArray/shell.js -f ecma_6/TypedArray/subarray.js
[  853s] ecma_6/TypedArray/subarray.js:8:26 RangeError: attempting to construct out-of-bounds TypedArray on ArrayBuffer
[  853s] Stack:
[  853s]   @ecma_6/TypedArray/subarray.js:8:26
[  853s] REGRESSION - ecma_6/TypedArray/subarray.js
...
js/src/tests/ecma_6/ArrayBuffer/CloneArrayBuffer.js
[  862s] ## ecma_6/ArrayBuffer/CloneArrayBuffer.js: rc = 3, run time = 0.154005
[  862s] /home/abuild/rpmbuild/BUILD/mozilla/js/src/js/src/shell/js -f shell.js -f ecma_6/shell.js -f ecma_6/ArrayBuffer/shell.js -f ecma_6/ArrayBuffer/CloneArrayBuffer.js
[  862s] 1264941: CloneArrayBuffer should be called with byteLength of source typedArray
[  862s] ecma_6/ArrayBuffer/CloneArrayBuffer.js:16:7 Error: Assertion failed: got 8, expected 0
[  862s] Stack:
[  862s]   test@ecma_6/ArrayBuffer/CloneArrayBuffer.js:16:7
[  862s]   @ecma_6/ArrayBuffer/CloneArrayBuffer.js:27:1
[  862s] REGRESSION - ecma_6/ArrayBuffer/CloneArrayBuffer.js
================================================


Expected results:

Tests should have succeeded.

Comment 1

[Jason Orendorff [:jorendorff]]

Charles, thank you for the report. 

All of these tests happen to use BYTES_PER_ELEMENT. Can you run the JS shell you built manually? What happens if you paste in this code at the `js>` prompt?

    for (let name of Object.getOwnPropertyNames(this)) { 
      let c = this[name];                                  
      if (c != null && c.BYTES_PER_ELEMENT)                
      print(`${c.name}: ${c.BYTES_PER_ELEMENT}`);          
    }

What if you paste this in?

    new Int32Array(new Int8Array([1,2,3,4]).buffer)[0]

Comment 2

[Jason Orendorff [:jorendorff]]

On my machine, it looks like this:

    ~/work/gecko/js/src/build_DBG.OBJ$ ./dist/bin/js
    js> for (let name of Object.getOwnPropertyNames(this)) { 
          let c = this[name];                                  
          if (c != null && c.BYTES_PER_ELEMENT)                
          print(`${c.name}: ${c.BYTES_PER_ELEMENT}`);          
        }
    Int8Array: 1
    Uint8Array: 1
    Int16Array: 2
    Uint16Array: 2
    Int32Array: 4
    Uint32Array: 4
    Float32Array: 4
    Float64Array: 8
    Uint8ClampedArray: 1
    js> new Int32Array(new Int8Array([1,2,3,4]).buffer)[0]
    67305985

Comment 3

[Jason Orendorff [:jorendorff]]

Also: The JITs are completely disabled when you build for s390x, right?

Comment 4

[Charles Robertson]

(In reply to Jason Orendorff [:jorendorff] from comment #2)
> On my machine, it looks like this:
> 
>     ~/work/gecko/js/src/build_DBG.OBJ$ ./dist/bin/js
>     js> for (let name of Object.getOwnPropertyNames(this)) { 
>           let c = this[name];                                  
>           if (c != null && c.BYTES_PER_ELEMENT)                
>           print(`${c.name}: ${c.BYTES_PER_ELEMENT}`);          
>         }
>     Int8Array: 1
>     Uint8Array: 1
>     Int16Array: 2
>     Uint16Array: 2
>     Int32Array: 4
>     Uint32Array: 4
>     Float32Array: 4
>     Float64Array: 8
>     Uint8ClampedArray: 1
>     js> new Int32Array(new Int8Array([1,2,3,4]).buffer)[0]
>     67305985

I was able to verify that *.BYTES_PER_ELEMENT == 0 in each one of these failing tests. It appears this value is not getting set in the JS engine. I'll keep looking into it.

Comment 5

[Charles Robertson]

(In reply to Jason Orendorff [:jorendorff] from comment #3)
> Also: The JITs are completely disabled when you build for s390x, right?

Our build script has us running the JIT tests after running the JS tests:

============================================================================
# Run SpiderMonkey tests
tests/jstests.py -d -s -t 1800 --no-progress ../../js/src/js/src/shell/js
# Run basic JIT tests
jit-test/jit_test.py -s -t 1800 --no-progress ../../js/src/js/src/shell/js basic
============================================================================

The build script exits before executing the JIT tests. Why should the JITs be disabled on s390x?

Comment 6

[Jan de Mooij [:jandem]]

(In reply to Charles Robertson from comment #5)
> Why should the JITs be disabled on s390x?

Because we only have JIT backends for x86/x64, ARM/ARM64, MIPS32/MIPS64. On all other platforms the JITs will be disabled. Adding a new JIT backend is a non-trivial amount of work.

Comment 7

[Jason Orendorff [:jorendorff]]

Charles, it's good to run the jit-tests. They should pass, even though the JITs are disabled.

(They are tests designed to check that JS still works when the JITs are on. But if the JITs are off, JS should still work, just slower.)

Comment 8

[Jason Orendorff [:jorendorff]]

OK, try this.

Find this point in the code:

  https://searchfox.org/mozilla-central/source/js/src/vm/TypedArrayObject.cpp#349

and insert this printf:

  printf("%s: C++ const = %lu, JS property spec = %ld\n",
         instanceClass()->name,
         (unsigned long) BYTES_PER_ELEMENT,
         (long) instanceClass()->spec->constructorProperties[0].value.int32);

Here's what it looks like for me:

    ~/work/gecko/js/src/build_DBG.OBJ$ ./dist/bin/js
    Uint8Array: C++ const = 1, JS property spec = 1
    Int32Array: C++ const = 4, JS property spec = 4
    js> Int8Array.BYTES_PER_ELEMENT
    Int8Array: C++ const = 1, JS property spec = 1
    1
    js> Float64Array.BYTES_PER_ELEMENT
    Float64Array: C++ const = 8, JS property spec = 8
    8

Comment 9

[Charles Robertson]

(In reply to Jason Orendorff [:jorendorff] from comment #8)
> OK, try this.
> 
> Find this point in the code:
> 
>  
> https://searchfox.org/mozilla-central/source/js/src/vm/TypedArrayObject.
> cpp#349
> 
> and insert this printf:
> 
>   printf("%s: C++ const = %lu, JS property spec = %ld\n",
>          instanceClass()->name,
>          (unsigned long) BYTES_PER_ELEMENT,
>          (long) instanceClass()->spec->constructorProperties[0].value.int32);
> 
> Here's what it looks like for me:
> 
>     ~/work/gecko/js/src/build_DBG.OBJ$ ./dist/bin/js
>     Uint8Array: C++ const = 1, JS property spec = 1
>     Int32Array: C++ const = 4, JS property spec = 4
>     js> Int8Array.BYTES_PER_ELEMENT
>     Int8Array: C++ const = 1, JS property spec = 1
>     1
>     js> Float64Array.BYTES_PER_ELEMENT
>     Float64Array: C++ const = 8, JS property spec = 8
>     8

OK. I finally got it. Here's my results with the printf() you provided above in the right place on my s390x build:

Uint8Array: C++ const = 1, JS property spec = 0
Int32Array: C++ const = 4, JS property spec = 0
js> Int8Array.BYTES_PER_ELEMENT
Uint8Array: C++ const = 1, JS property spec = 0
0
js> Float64Array.BYTES_PER_ELEMENT
Float64Array: C++ const = 8, JS property spec = 0
0

Just for a sanity check I got the same results you showed in comment 8 on a x86_64 build. Where does this JS property spec get set?

Comment 10

[Charles Robertson]

I have provided the information requested by Jason Orendorff in comment 9 seven days ago but have not heard back. I am quite new to this code and do not understand the architecture of mozjs very well. I would really appreciate any comments or suggestions on where I can look in the code base to find and discover where this "JS property spec" (instanceClass()->spec->constructorProperties[0].value.int32) should be set as we have customers waiting on this fix.

Comment 11

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Clearly ni on Naveed as he no longer works at Mozilla.

Comment 13

[Jason Orendorff [:jorendorff]]

It's set at compile time, using this macro:
  https://searchfox.org/mozilla-central/source/js/src/vm/TypedArrayObject.cpp#2041

I'm sorry your comment never reached me -- I can't read all bugmail, the volume is overwhelming. But set ni?me any time.