1467673 - self-test/assertRecoveredOnBailout-1.js failure on tsan with clang 6

Assignee

Description

•

4 years ago

https://treeherder.mozilla.org/logviewer.html#?job_id=182444077&repo=try&lineNumber=50618

[task 2018-06-08T02:07:42.945Z] ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T02:07:42.945Z] ==20671==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20671)
[task 2018-06-08T02:07:42.945Z] ==20671==The signal is caused by a WRITE memory access.
[task 2018-06-08T02:07:42.945Z] ==20671==Hint: address points to the zero page.
[task 2018-06-08T02:07:42.945Z]     #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095)
[task 2018-06-08T02:07:42.945Z]     #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479)
[task 2018-06-08T02:07:42.945Z]     #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02)
[task 2018-06-08T02:07:42.945Z]     #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810)
[task 2018-06-08T02:07:42.945Z]     #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810)
[task 2018-06-08T02:07:42.945Z]     #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965)
[task 2018-06-08T02:07:42.946Z]     #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad)
[task 2018-06-08T02:07:42.946Z]     #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad)
[task 2018-06-08T02:07:42.946Z]     #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716)
[task 2018-06-08T02:07:42.946Z]     #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716)
[task 2018-06-08T02:07:42.946Z]     #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a)
[task 2018-06-08T02:07:42.946Z]     #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a)
[task 2018-06-08T02:07:42.946Z]     #12 <null> <null> (0x7fffb3c106c6)
[task 2018-06-08T02:07:42.946Z] 
[task 2018-06-08T02:07:42.946Z] ThreadSanitizer can not provide additional info.
[task 2018-06-08T02:07:42.946Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const
[task 2018-06-08T02:07:42.946Z] ==20671==ABORTING
[task 2018-06-08T02:07:42.947Z] Exit code: 66
[task 2018-06-08T02:07:42.947Z] FAIL - self-test/assertRecoveredOnBailout-1.js
[task 2018-06-08T02:07:42.947Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | ThreadSanitizer:DEADLYSIGNAL (code 66, args "") [0.8 s]
[task 2018-06-08T02:07:42.947Z] {"action": "test_start", "jitflags": "", "pid": 20671, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.174638}
[task 2018-06-08T02:07:42.947Z] {"action": "test_end", "extra": {"jitflags": "", "pid": 20671}, "jitflags": "", "message": "ThreadSanitizer:DEADLYSIGNAL", "pid": 20671, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.945426}
[task 2018-06-08T02:07:42.947Z] INFO exit-status     : 66
[task 2018-06-08T02:07:42.947Z] INFO timed-out       : False
[task 2018-06-08T02:07:42.947Z] INFO stderr         2> ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T02:07:42.947Z] INFO stderr         2> ==20671==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20671)
[task 2018-06-08T02:07:42.947Z] INFO stderr         2> ==20671==The signal is caused by a WRITE memory access.
[task 2018-06-08T02:07:42.947Z] INFO stderr         2> ==20671==Hint: address points to the zero page.
[task 2018-06-08T02:07:42.947Z] INFO stderr         2> #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> #12 <null> <null> (0x7fffb3c106c6)
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> 
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> ThreadSanitizer can not provide additional info.
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const
[task 2018-06-08T02:07:42.948Z] INFO stderr         2> ==20671==ABORTING
[task 2018-06-08T02:07:42.990Z] Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350
[task 2018-06-08T02:07:42.990Z] ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T02:07:42.990Z] ==20692==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffb880 sp 0x7fffffffb860 T20692)
[task 2018-06-08T02:07:42.990Z] ==20692==The signal is caused by a WRITE memory access.
[task 2018-06-08T02:07:42.990Z] ==20692==Hint: address points to the zero page.
[task 2018-06-08T02:07:42.990Z]     #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49)
[task 2018-06-08T02:07:42.990Z]     #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569)
[task 2018-06-08T02:07:42.990Z]     #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46)
[task 2018-06-08T02:07:42.990Z]     #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46)
[task 2018-06-08T02:07:42.990Z]     #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9)
[task 2018-06-08T02:07:42.990Z]     #5 js::CallFromStack(JSContext*, JS::CallArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66d500)
[task 2018-06-08T02:07:42.991Z]     #6 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2372:14 (js+0x756de9)
[task 2018-06-08T02:07:42.991Z]     #7 <null> <null> (0x7fffb3c03e30)
[task 2018-06-08T02:07:42.991Z] 
[task 2018-06-08T02:07:42.991Z] ThreadSanitizer can not provide additional info.
[task 2018-06-08T02:07:42.991Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL
[task 2018-06-08T02:07:42.991Z] ==20692==ABORTING
[task 2018-06-08T02:07:42.991Z] Exit code: 66
[task 2018-06-08T02:07:42.991Z] FAIL - self-test/assertRecoveredOnBailout-1.js
[task 2018-06-08T02:07:42.991Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 (code 66, args "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3") [0.8 s]
[task 2018-06-08T02:07:42.991Z] {"action": "test_start", "jitflags": "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3", "pid": 20692, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.200808}
[task 2018-06-08T02:07:42.991Z] {"action": "test_end", "extra": {"jitflags": "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3", "pid": 20692}, "jitflags": "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3", "message": "Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350", "pid": 20692, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.985377}
[task 2018-06-08T02:07:42.991Z] INFO exit-status     : 66
[task 2018-06-08T02:07:42.991Z] INFO timed-out       : False
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> ==20692==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffb880 sp 0x7fffffffb860 T20692)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> ==20692==The signal is caused by a WRITE memory access.
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> ==20692==Hint: address points to the zero page.
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #5 js::CallFromStack(JSContext*, JS::CallArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66d500)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #6 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2372:14 (js+0x756de9)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> #7 <null> <null> (0x7fffb3c03e30)
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> 
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> ThreadSanitizer can not provide additional info.
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL
[task 2018-06-08T02:07:42.991Z] INFO stderr         2> ==20692==ABORTING
[task 2018-06-08T02:07:43.026Z] TEST-PASS | js/src/jit-test/tests/self-test/baselineCompile-Bug1444894.js | Success (code 0, args "") [0.6 s]
[task 2018-06-08T02:07:43.026Z] {"action": "test_start", "jitflags": "", "pid": 20740, "source": "jittests", "test": "self-test/baselineCompile-Bug1444894.js", "thread": "main", "time": 1528423662.416491}
[task 2018-06-08T02:07:43.026Z] {"action": "test_end", "extra": {"jitflags": "", "pid": 20740}, "jitflags": "", "message": "Success", "pid": 20740, "source": "jittests", "status": "PASS", "test": "self-test/baselineCompile-Bug1444894.js", "thread": "main", "time": 1528423663.026303}
[task 2018-06-08T02:07:43.125Z] Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350
[task 2018-06-08T02:07:43.126Z] ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T02:07:43.126Z] ==20737==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffbd80 sp 0x7fffffffbd60 T20737)
[task 2018-06-08T02:07:43.126Z] ==20737==The signal is caused by a WRITE memory access.
[task 2018-06-08T02:07:43.126Z] ==20737==Hint: address points to the zero page.
[task 2018-06-08T02:07:43.126Z]     #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49)
[task 2018-06-08T02:07:43.126Z]     #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569)
[task 2018-06-08T02:07:43.126Z]     #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46)
[task 2018-06-08T02:07:43.126Z]     #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46)
[task 2018-06-08T02:07:43.126Z]     #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9)
[task 2018-06-08T02:07:43.126Z]     #5 CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66407f)
[task 2018-06-08T02:07:43.126Z]     #6 Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3122 (js+0x66407f)
[task 2018-06-08T02:07:43.126Z]     #7 js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:421:12 (js+0x656b0f)
[task 2018-06-08T02:07:43.126Z]     #8 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:704:15 (js+0x66e60e)
[task 2018-06-08T02:07:43.126Z]     #9 js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:736:12 (js+0x66e85d)
[task 2018-06-08T02:07:43.126Z]     #10 ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4737:12 (js+0xc34506)
[task 2018-06-08T02:07:43.126Z]     #11 JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4770:12 (js+0xc346a6)
[task 2018-06-08T02:07:43.126Z]     #12 RunFile /builds/worker/workspace/build/src/js/src/shell/js.cpp:847:14 (js+0x5000fe)
[task 2018-06-08T02:07:43.126Z]     #13 Process(JSContext*, char const*, bool, FileKind) /builds/worker/workspace/build/src/js/src/shell/js.cpp:1317 (js+0x5000fe)
[task 2018-06-08T02:07:43.126Z]     #14 ProcessArgs /builds/worker/workspace/build/src/js/src/shell/js.cpp:8468:18 (js+0x4da60b)
[task 2018-06-08T02:07:43.126Z]     #15 Shell /builds/worker/workspace/build/src/js/src/shell/js.cpp:8892 (js+0x4da60b)
[task 2018-06-08T02:07:43.126Z]     #16 main /builds/worker/workspace/build/src/js/src/shell/js.cpp:9371 (js+0x4da60b)
[task 2018-06-08T02:07:43.126Z]     #17 __libc_start_main /build/eglibc-ZYONVs/eglibc-2.13/csu/libc-start.c:244 (libc.so.6+0x1eeac)
[task 2018-06-08T02:07:43.126Z]     #18 _start <null> (js+0x43c69c)
[task 2018-06-08T02:07:43.126Z] 
[task 2018-06-08T02:07:43.126Z] ThreadSanitizer can not provide additional info.
[task 2018-06-08T02:07:43.126Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL
[task 2018-06-08T02:07:43.126Z] ==20737==ABORTING
[task 2018-06-08T02:07:43.126Z] Exit code: 66
[task 2018-06-08T02:07:43.126Z] FAIL - self-test/assertRecoveredOnBailout-1.js
[task 2018-06-08T02:07:43.126Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 (code 66, args "--no-baseline --no-ion") [0.8 s]
[task 2018-06-08T02:07:43.126Z] {"action": "test_start", "jitflags": "--no-baseline --no-ion", "pid": 20737, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.358741}
[task 2018-06-08T02:07:43.126Z] {"action": "test_end", "extra": {"jitflags": "--no-baseline --no-ion", "pid": 20737}, "jitflags": "--no-baseline --no-ion", "message": "Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350", "pid": 20737, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423663.123276}
[task 2018-06-08T02:07:43.126Z] INFO exit-status     : 66
[task 2018-06-08T02:07:43.126Z] INFO timed-out       : False
[task 2018-06-08T02:07:43.126Z] INFO stderr         2> Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350
[task 2018-06-08T02:07:43.126Z] INFO stderr         2> ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T02:07:43.126Z] INFO stderr         2> ==20737==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffbd80 sp 0x7fffffffbd60 T20737)
[task 2018-06-08T02:07:43.126Z] INFO stderr         2> ==20737==The signal is caused by a WRITE memory access.
[task 2018-06-08T02:07:43.126Z] INFO stderr         2> ==20737==Hint: address points to the zero page.
[task 2018-06-08T02:07:43.126Z] INFO stderr         2> #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49)
[task 2018-06-08T02:07:43.126Z] INFO stderr         2> #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #5 CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66407f)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #6 Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3122 (js+0x66407f)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #7 js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:421:12 (js+0x656b0f)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #8 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:704:15 (js+0x66e60e)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #9 js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:736:12 (js+0x66e85d)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #10 ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4737:12 (js+0xc34506)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #11 JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4770:12 (js+0xc346a6)
[task 2018-06-08T02:07:43.127Z] INFO stderr         2> #12 RunFile /builds/worker/workspace/build/src/js/src/shell/js.cpp:847:14 (js+0x5000fe)
[task 2018-06-08T02:07:43.128Z] INFO stderr         2> #13 Process(JSContext*, char const*, bool, FileKind) /builds/worker/workspace/build/src/js/src/shell/js.cpp:1317 (js+0x5000fe)
[task 2018-06-08T02:07:43.128Z] INFO stderr         2> #14 ProcessArgs /builds/worker/workspace/build/src/js/src/shell/js.cpp:8468:18 (js+0x4da60b)
[task 2018-06-08T02:07:43.128Z] INFO stderr         2> #15 Shell /builds/worker/workspace/build/src/js/src/shell/js.cpp:8892 (js+0x4da60b)
[task 2018-06-08T02:07:43.129Z] INFO stderr         2> #16 main /builds/worker/workspace/build/src/js/src/shell/js.cpp:9371 (js+0x4da60b)
[task 2018-06-08T02:07:43.129Z] INFO stderr         2> #17 __libc_start_main /build/eglibc-ZYONVs/eglibc-2.13/csu/libc-start.c:244 (libc.so.6+0x1eeac)
[task 2018-06-08T02:07:43.129Z] INFO stderr         2> #18 _start <null> (js+0x43c69c)
[task 2018-06-08T02:07:43.129Z] INFO stderr         2> 
[task 2018-06-08T02:07:43.129Z] INFO stderr         2> ThreadSanitizer can not provide additional info.
[task 2018-06-08T02:07:43.129Z] INFO stderr         2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL
[task 2018-06-08T02:07:43.129Z] INFO stderr         2> ==20737==ABORTING

https://treeherder.mozilla.org/#/jobs?repo=try&revision=348c32e0327a183827cdd95f42cb6eda575540a3&selectedJob=182444077

Mike Hommey [:glandium]

Assignee

Comment 1

•

4 years ago

It seems it's not a thread sanity problem but rather some assumptions from the test breaking.

Jan de Mooij [:jandem]

Comment 2

•

4 years ago

Hm this now fails with TSan's exit code (66) instead of the one expected by the test (a segfault like -11).

This is brittle. Nicolas, why can't this test just quit(0) instead of crash()? I don't see what the difference is if the test harness is just going to ignore these crashes anyway.

Flags: needinfo?(nicolas.b.pierron)

Jan de Mooij [:jandem]

Comment 3

•

4 years ago

Oh I see, the idea is that the test always crashes...

glandium, an easy fix is to change the |rc == 1| here to |rc in (1, 66)| and update the comment to mention TSan, too:

https://searchfox.org/mozilla-central/rev/c621276fbdd9591f52009042d959b9e19b66d49f/js/src/tests/lib/jittests.py#467

Mike Hommey [:glandium]

Assignee

Comment 4

•

4 years ago

Testing that:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=ae3aaf10e475d5f070f27a8e1aad84a556915310

Mike Hommey [:glandium]

Assignee

Comment 5

•

4 years ago

Unexpected clang changes slipped in, trying again:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=2c90096c6332300554de6c885f63a4461380ba2c

Mike Hommey [:glandium]

Assignee

Comment 6

•

4 years ago

Still failing, with a shorter error message:

[task 2018-06-08T07:47:32.785Z] ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T07:47:32.785Z] ==20717==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20717)
[task 2018-06-08T07:47:32.785Z] ==20717==The signal is caused by a WRITE memory access.
[task 2018-06-08T07:47:32.785Z] ==20717==Hint: address points to the zero page.
[task 2018-06-08T07:47:32.785Z]     #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095)
[task 2018-06-08T07:47:32.785Z]     #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479)
[task 2018-06-08T07:47:32.785Z]     #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02)
[task 2018-06-08T07:47:32.785Z]     #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810)
[task 2018-06-08T07:47:32.785Z]     #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810)
[task 2018-06-08T07:47:32.785Z]     #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965)
[task 2018-06-08T07:47:32.785Z]     #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad)
[task 2018-06-08T07:47:32.785Z]     #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad)
[task 2018-06-08T07:47:32.785Z]     #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716)
[task 2018-06-08T07:47:32.785Z]     #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716)
[task 2018-06-08T07:47:32.785Z]     #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a)
[task 2018-06-08T07:47:32.785Z]     #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a)
[task 2018-06-08T07:47:32.785Z]     #12 <null> <null> (0x00175c5da6c6)
[task 2018-06-08T07:47:32.785Z] 
[task 2018-06-08T07:47:32.785Z] ThreadSanitizer can not provide additional info.
[task 2018-06-08T07:47:32.785Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const
[task 2018-06-08T07:47:32.785Z] ==20717==ABORTING
[task 2018-06-08T07:47:32.785Z] Exit code: 66
[task 2018-06-08T07:47:32.785Z] FAIL - self-test/assertRecoveredOnBailout-1.js
[task 2018-06-08T07:47:32.785Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | ThreadSanitizer:DEADLYSIGNAL (code 66, args "") [0.7 s]
[task 2018-06-08T07:47:32.785Z] {"action": "test_start", "jitflags": "", "pid": 20717, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528444052.060126}
[task 2018-06-08T07:47:32.785Z] {"action": "test_end", "extra": {"jitflags": "", "pid": 20717}, "jitflags": "", "message": "ThreadSanitizer:DEADLYSIGNAL", "pid": 20717, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528444052.785573}
[task 2018-06-08T07:47:32.785Z] INFO exit-status     : 66
[task 2018-06-08T07:47:32.785Z] INFO timed-out       : False
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> ThreadSanitizer:DEADLYSIGNAL
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> ==20717==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20717)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> ==20717==The signal is caused by a WRITE memory access.
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> ==20717==Hint: address points to the zero page.
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> #12 <null> <null> (0x00175c5da6c6)
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> 
[task 2018-06-08T07:47:32.786Z] INFO stderr         2> ThreadSanitizer can not provide additional info.
[task 2018-06-08T07:47:32.787Z] INFO stderr         2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const
[task 2018-06-08T07:47:32.787Z] INFO stderr         2> ==20717==ABORTING

Mike Hommey [:glandium]

Assignee

Comment 7

•

4 years ago

https://treeherder.mozilla.org/logviewer.html#?job_id=182470489&repo=try&lineNumber=50629

Mike Hommey [:glandium]

Assignee

Comment 8

•

4 years ago

It seems that this one is, for some reason, not printing out the assert message.

Nicolas B. Pierron [:nbp]

Comment 9

•

4 years ago

(In reply to Jan de Mooij [:jandem] from comment #2)
> This is brittle. Nicolas, why can't this test just quit(0) instead of
> crash()? I don't see what the difference is if the test harness is just
> going to ignore these crashes anyway.

The test harness does not ignore the result, we expect the test case to crash, with the test case header:

// |jit-test| crash

Using quit(0), will cause test cases using assertRecoveredOnBailout to be converted to no-op which would not check anything.

The suggestion from comment 2 sounds good to me.

Flags: needinfo?(nicolas.b.pierron)

Mike Hommey [:glandium]

Assignee

Comment 10

•

4 years ago

(In reply to Nicolas B. Pierron [:nbp] {backlog: 36} from comment #9)
> The suggestion from comment 2 sounds good to me.

Except it's not enough cf. comment 6 and following.

Flags: needinfo?(nicolas.b.pierron)

Nicolas B. Pierron [:nbp]

Comment 11

•

4 years ago

I think adding MOZ_TSAN_BLACKLIST on MOZ_CrashOOL definition should fix this issue, or convert it to Bug 1469910.

Flags: needinfo?(nicolas.b.pierron)

Nicolas B. Pierron [:nbp]

Updated

•

4 years ago

Priority: -- → P3

Mike Hommey [:glandium]

Assignee

Comment 12

•

4 years ago

(In reply to Nicolas B. Pierron [:nbp] {backlog: 39} from comment #11)
> I think adding MOZ_TSAN_BLACKLIST on MOZ_CrashOOL definition should fix this
> issue, or convert it to Bug 1469910.

It only partially does, because not all crashes go through MOZ_CrashOOL. I found another workaround, though.

Mike Hommey [:glandium]

Assignee

Updated

•

4 years ago

Blocks: 1478919

Comment hidden (mozreview-request)

self-test/assertRecoveredOnBailout-1.js relies on the shell actually
crashing, but TSAN catches that instead, and returns its own error code
instead of -11.

TSAN's value, however, is not in catching crashes, so we disable its
handling of segfaults while running the JIT tests. Crashes would still
happen and cause tests failures, while allowing the harness to catch the
expected crash from self-test/assertRecoveredOnBailout-1.js.

Review commit: https://reviewboard.mozilla.org/r/259874/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/259874/

Mike Hommey [:glandium]

Assignee

Updated

•

4 years ago

Assignee: nobody → mh+mozilla

Jan de Mooij [:jandem]

Comment 14

•

4 years ago

mozreview-review

Comment on attachment 8995427 [details]
Bug 1467673 - Disable segfault handling by TSAN when running JIT tests.

https://reviewboard.mozilla.org/r/259874/#review266918

If jit-tests are green with this and it doesn't affect TSan otherwise (looks like it doesn't), this LGTM.

Attachment #8995427 - Flags: review?(jdemooij) → review+

Pulsebot

Comment 15

•

4 years ago

Pushed by mh@glandium.org:
https://hg.mozilla.org/integration/autoland/rev/060f8e446844
Disable segfault handling by TSAN when running JIT tests. r=jandem

Daniel Varga [:dvarga]

Comment 16

•

4 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/060f8e446844

Status: NEW → RESOLVED

Closed: 4 years ago

status-firefox63: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla63

Bugzilla

self-test/assertRecoveredOnBailout-1.js failure on tsan with clang 6

Categories

(Core :: JavaScript Engine: JIT, defect, P3)

Tracking

()

People

(Reporter: glandium, Assigned: glandium)

References

Details

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Comment 9

Comment 10

Comment 11

Updated

Comment 12

Updated

Comment 13

Updated

Comment 14

Comment 15

Comment 16