Closed Bug 1467673 Opened 7 years ago Closed 7 years ago

self-test/assertRecoveredOnBailout-1.js failure on tsan with clang 6

Categories

(Core :: JavaScript Engine: JIT, defect, P3)

Product:
Core
Component:
JavaScript Engine: JIT
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla63
Tracking Flags:
Tracking Status
firefox63 --- fixed

People

(Reporter: glandium, Assigned: glandium)

References

Details

Attachments

(1 file)

Bug 1467673 - Disable segfault handling by TSAN when running JIT tests.
59 bytes, text/x-review-board-request
jandem
: review+
Details
https://treeherder.mozilla.org/logviewer.html#?job_id=182444077&repo=try&lineNumber=50618 [task 2018-06-08T02:07:42.945Z] ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T02:07:42.945Z] ==20671==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20671) [task 2018-06-08T02:07:42.945Z] ==20671==The signal is caused by a WRITE memory access. [task 2018-06-08T02:07:42.945Z] ==20671==Hint: address points to the zero page. [task 2018-06-08T02:07:42.945Z] #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095) [task 2018-06-08T02:07:42.945Z] #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479) [task 2018-06-08T02:07:42.945Z] #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02) [task 2018-06-08T02:07:42.945Z] #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810) [task 2018-06-08T02:07:42.945Z] #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810) [task 2018-06-08T02:07:42.945Z] #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965) [task 2018-06-08T02:07:42.946Z] #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad) [task 2018-06-08T02:07:42.946Z] #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad) [task 2018-06-08T02:07:42.946Z] #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716) [task 2018-06-08T02:07:42.946Z] #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716) [task 2018-06-08T02:07:42.946Z] #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a) [task 2018-06-08T02:07:42.946Z] #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a) [task 2018-06-08T02:07:42.946Z] #12 <null> <null> (0x7fffb3c106c6) [task 2018-06-08T02:07:42.946Z] [task 2018-06-08T02:07:42.946Z] ThreadSanitizer can not provide additional info. [task 2018-06-08T02:07:42.946Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const [task 2018-06-08T02:07:42.946Z] ==20671==ABORTING [task 2018-06-08T02:07:42.947Z] Exit code: 66 [task 2018-06-08T02:07:42.947Z] FAIL - self-test/assertRecoveredOnBailout-1.js [task 2018-06-08T02:07:42.947Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | ThreadSanitizer:DEADLYSIGNAL (code 66, args "") [0.8 s] [task 2018-06-08T02:07:42.947Z] {"action": "test_start", "jitflags": "", "pid": 20671, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.174638} [task 2018-06-08T02:07:42.947Z] {"action": "test_end", "extra": {"jitflags": "", "pid": 20671}, "jitflags": "", "message": "ThreadSanitizer:DEADLYSIGNAL", "pid": 20671, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.945426} [task 2018-06-08T02:07:42.947Z] INFO exit-status : 66 [task 2018-06-08T02:07:42.947Z] INFO timed-out : False [task 2018-06-08T02:07:42.947Z] INFO stderr 2> ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T02:07:42.947Z] INFO stderr 2> ==20671==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20671) [task 2018-06-08T02:07:42.947Z] INFO stderr 2> ==20671==The signal is caused by a WRITE memory access. [task 2018-06-08T02:07:42.947Z] INFO stderr 2> ==20671==Hint: address points to the zero page. [task 2018-06-08T02:07:42.947Z] INFO stderr 2> #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> #12 <null> <null> (0x7fffb3c106c6) [task 2018-06-08T02:07:42.948Z] INFO stderr 2> [task 2018-06-08T02:07:42.948Z] INFO stderr 2> ThreadSanitizer can not provide additional info. [task 2018-06-08T02:07:42.948Z] INFO stderr 2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const [task 2018-06-08T02:07:42.948Z] INFO stderr 2> ==20671==ABORTING [task 2018-06-08T02:07:42.990Z] Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 [task 2018-06-08T02:07:42.990Z] ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T02:07:42.990Z] ==20692==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffb880 sp 0x7fffffffb860 T20692) [task 2018-06-08T02:07:42.990Z] ==20692==The signal is caused by a WRITE memory access. [task 2018-06-08T02:07:42.990Z] ==20692==Hint: address points to the zero page. [task 2018-06-08T02:07:42.990Z] #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49) [task 2018-06-08T02:07:42.990Z] #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569) [task 2018-06-08T02:07:42.990Z] #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46) [task 2018-06-08T02:07:42.990Z] #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46) [task 2018-06-08T02:07:42.990Z] #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9) [task 2018-06-08T02:07:42.990Z] #5 js::CallFromStack(JSContext*, JS::CallArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66d500) [task 2018-06-08T02:07:42.991Z] #6 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2372:14 (js+0x756de9) [task 2018-06-08T02:07:42.991Z] #7 <null> <null> (0x7fffb3c03e30) [task 2018-06-08T02:07:42.991Z] [task 2018-06-08T02:07:42.991Z] ThreadSanitizer can not provide additional info. [task 2018-06-08T02:07:42.991Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL [task 2018-06-08T02:07:42.991Z] ==20692==ABORTING [task 2018-06-08T02:07:42.991Z] Exit code: 66 [task 2018-06-08T02:07:42.991Z] FAIL - self-test/assertRecoveredOnBailout-1.js [task 2018-06-08T02:07:42.991Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 (code 66, args "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3") [0.8 s] [task 2018-06-08T02:07:42.991Z] {"action": "test_start", "jitflags": "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3", "pid": 20692, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.200808} [task 2018-06-08T02:07:42.991Z] {"action": "test_end", "extra": {"jitflags": "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3", "pid": 20692}, "jitflags": "--ion-eager --ion-check-range-analysis --ion-extra-checks --no-sse3", "message": "Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350", "pid": 20692, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.985377} [task 2018-06-08T02:07:42.991Z] INFO exit-status : 66 [task 2018-06-08T02:07:42.991Z] INFO timed-out : False [task 2018-06-08T02:07:42.991Z] INFO stderr 2> Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 [task 2018-06-08T02:07:42.991Z] INFO stderr 2> ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T02:07:42.991Z] INFO stderr 2> ==20692==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffb880 sp 0x7fffffffb860 T20692) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> ==20692==The signal is caused by a WRITE memory access. [task 2018-06-08T02:07:42.991Z] INFO stderr 2> ==20692==Hint: address points to the zero page. [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #5 js::CallFromStack(JSContext*, JS::CallArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66d500) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #6 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2372:14 (js+0x756de9) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> #7 <null> <null> (0x7fffb3c03e30) [task 2018-06-08T02:07:42.991Z] INFO stderr 2> [task 2018-06-08T02:07:42.991Z] INFO stderr 2> ThreadSanitizer can not provide additional info. [task 2018-06-08T02:07:42.991Z] INFO stderr 2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL [task 2018-06-08T02:07:42.991Z] INFO stderr 2> ==20692==ABORTING [task 2018-06-08T02:07:43.026Z] TEST-PASS | js/src/jit-test/tests/self-test/baselineCompile-Bug1444894.js | Success (code 0, args "") [0.6 s] [task 2018-06-08T02:07:43.026Z] {"action": "test_start", "jitflags": "", "pid": 20740, "source": "jittests", "test": "self-test/baselineCompile-Bug1444894.js", "thread": "main", "time": 1528423662.416491} [task 2018-06-08T02:07:43.026Z] {"action": "test_end", "extra": {"jitflags": "", "pid": 20740}, "jitflags": "", "message": "Success", "pid": 20740, "source": "jittests", "status": "PASS", "test": "self-test/baselineCompile-Bug1444894.js", "thread": "main", "time": 1528423663.026303} [task 2018-06-08T02:07:43.125Z] Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 [task 2018-06-08T02:07:43.126Z] ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T02:07:43.126Z] ==20737==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffbd80 sp 0x7fffffffbd60 T20737) [task 2018-06-08T02:07:43.126Z] ==20737==The signal is caused by a WRITE memory access. [task 2018-06-08T02:07:43.126Z] ==20737==Hint: address points to the zero page. [task 2018-06-08T02:07:43.126Z] #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49) [task 2018-06-08T02:07:43.126Z] #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569) [task 2018-06-08T02:07:43.126Z] #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46) [task 2018-06-08T02:07:43.126Z] #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46) [task 2018-06-08T02:07:43.126Z] #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9) [task 2018-06-08T02:07:43.126Z] #5 CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66407f) [task 2018-06-08T02:07:43.126Z] #6 Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3122 (js+0x66407f) [task 2018-06-08T02:07:43.126Z] #7 js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:421:12 (js+0x656b0f) [task 2018-06-08T02:07:43.126Z] #8 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:704:15 (js+0x66e60e) [task 2018-06-08T02:07:43.126Z] #9 js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:736:12 (js+0x66e85d) [task 2018-06-08T02:07:43.126Z] #10 ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4737:12 (js+0xc34506) [task 2018-06-08T02:07:43.126Z] #11 JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4770:12 (js+0xc346a6) [task 2018-06-08T02:07:43.126Z] #12 RunFile /builds/worker/workspace/build/src/js/src/shell/js.cpp:847:14 (js+0x5000fe) [task 2018-06-08T02:07:43.126Z] #13 Process(JSContext*, char const*, bool, FileKind) /builds/worker/workspace/build/src/js/src/shell/js.cpp:1317 (js+0x5000fe) [task 2018-06-08T02:07:43.126Z] #14 ProcessArgs /builds/worker/workspace/build/src/js/src/shell/js.cpp:8468:18 (js+0x4da60b) [task 2018-06-08T02:07:43.126Z] #15 Shell /builds/worker/workspace/build/src/js/src/shell/js.cpp:8892 (js+0x4da60b) [task 2018-06-08T02:07:43.126Z] #16 main /builds/worker/workspace/build/src/js/src/shell/js.cpp:9371 (js+0x4da60b) [task 2018-06-08T02:07:43.126Z] #17 __libc_start_main /build/eglibc-ZYONVs/eglibc-2.13/csu/libc-start.c:244 (libc.so.6+0x1eeac) [task 2018-06-08T02:07:43.126Z] #18 _start <null> (js+0x43c69c) [task 2018-06-08T02:07:43.126Z] [task 2018-06-08T02:07:43.126Z] ThreadSanitizer can not provide additional info. [task 2018-06-08T02:07:43.126Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL [task 2018-06-08T02:07:43.126Z] ==20737==ABORTING [task 2018-06-08T02:07:43.126Z] Exit code: 66 [task 2018-06-08T02:07:43.126Z] FAIL - self-test/assertRecoveredOnBailout-1.js [task 2018-06-08T02:07:43.126Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 (code 66, args "--no-baseline --no-ion") [0.8 s] [task 2018-06-08T02:07:43.126Z] {"action": "test_start", "jitflags": "--no-baseline --no-ion", "pid": 20737, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423662.358741} [task 2018-06-08T02:07:43.126Z] {"action": "test_end", "extra": {"jitflags": "--no-baseline --no-ion", "pid": 20737}, "jitflags": "--no-baseline --no-ion", "message": "Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350", "pid": 20737, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528423663.123276} [task 2018-06-08T02:07:43.126Z] INFO exit-status : 66 [task 2018-06-08T02:07:43.126Z] INFO timed-out : False [task 2018-06-08T02:07:43.126Z] INFO stderr 2> Hit MOZ_CRASH(Cannot test assertRecoveredOnBailout) at /builds/worker/workspace/build/src/js/src/shell/js.cpp:3350 [task 2018-06-08T02:07:43.126Z] INFO stderr 2> ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T02:07:43.126Z] INFO stderr 2> ==20737==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052aa4a bp 0x7fffffffbd80 sp 0x7fffffffbd60 T20737) [task 2018-06-08T02:07:43.126Z] INFO stderr 2> ==20737==The signal is caused by a WRITE memory access. [task 2018-06-08T02:07:43.126Z] INFO stderr 2> ==20737==Hint: address points to the zero page. [task 2018-06-08T02:07:43.126Z] INFO stderr 2> #0 MOZ_CrashOOL /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 (js+0x52aa49) [task 2018-06-08T02:07:43.126Z] INFO stderr 2> #1 Crash(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp:3352:5 (js+0x4fd569) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #2 CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:274:15 (js+0x66ce46) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #3 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471 (js+0x66ce46) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #4 InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:520:12 (js+0x66d5e9) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #5 CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12 (js+0x66407f) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #6 Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3122 (js+0x66407f) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #7 js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:421:12 (js+0x656b0f) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #8 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:704:15 (js+0x66e60e) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #9 js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:736:12 (js+0x66e85d) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #10 ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4737:12 (js+0xc34506) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #11 JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4770:12 (js+0xc346a6) [task 2018-06-08T02:07:43.127Z] INFO stderr 2> #12 RunFile /builds/worker/workspace/build/src/js/src/shell/js.cpp:847:14 (js+0x5000fe) [task 2018-06-08T02:07:43.128Z] INFO stderr 2> #13 Process(JSContext*, char const*, bool, FileKind) /builds/worker/workspace/build/src/js/src/shell/js.cpp:1317 (js+0x5000fe) [task 2018-06-08T02:07:43.128Z] INFO stderr 2> #14 ProcessArgs /builds/worker/workspace/build/src/js/src/shell/js.cpp:8468:18 (js+0x4da60b) [task 2018-06-08T02:07:43.128Z] INFO stderr 2> #15 Shell /builds/worker/workspace/build/src/js/src/shell/js.cpp:8892 (js+0x4da60b) [task 2018-06-08T02:07:43.129Z] INFO stderr 2> #16 main /builds/worker/workspace/build/src/js/src/shell/js.cpp:9371 (js+0x4da60b) [task 2018-06-08T02:07:43.129Z] INFO stderr 2> #17 __libc_start_main /build/eglibc-ZYONVs/eglibc-2.13/csu/libc-start.c:244 (libc.so.6+0x1eeac) [task 2018-06-08T02:07:43.129Z] INFO stderr 2> #18 _start <null> (js+0x43c69c) [task 2018-06-08T02:07:43.129Z] INFO stderr 2> [task 2018-06-08T02:07:43.129Z] INFO stderr 2> ThreadSanitizer can not provide additional info. [task 2018-06-08T02:07:43.129Z] INFO stderr 2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/mfbt/Assertions.cpp:33:3 in MOZ_CrashOOL [task 2018-06-08T02:07:43.129Z] INFO stderr 2> ==20737==ABORTING https://treeherder.mozilla.org/#/jobs?repo=try&revision=348c32e0327a183827cdd95f42cb6eda575540a3&selectedJob=182444077
It seems it's not a thread sanity problem but rather some assumptions from the test breaking.
Hm this now fails with TSan's exit code (66) instead of the one expected by the test (a segfault like -11). This is brittle. Nicolas, why can't this test just quit(0) instead of crash()? I don't see what the difference is if the test harness is just going to ignore these crashes anyway.
Flags: needinfo?(nicolas.b.pierron)
Oh I see, the idea is that the test always crashes... glandium, an easy fix is to change the |rc == 1| here to |rc in (1, 66)| and update the comment to mention TSan, too: https://searchfox.org/mozilla-central/rev/c621276fbdd9591f52009042d959b9e19b66d49f/js/src/tests/lib/jittests.py#467
Still failing, with a shorter error message: [task 2018-06-08T07:47:32.785Z] ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T07:47:32.785Z] ==20717==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20717) [task 2018-06-08T07:47:32.785Z] ==20717==The signal is caused by a WRITE memory access. [task 2018-06-08T07:47:32.785Z] ==20717==Hint: address points to the zero page. [task 2018-06-08T07:47:32.785Z] #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095) [task 2018-06-08T07:47:32.785Z] #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479) [task 2018-06-08T07:47:32.785Z] #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02) [task 2018-06-08T07:47:32.785Z] #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810) [task 2018-06-08T07:47:32.785Z] #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810) [task 2018-06-08T07:47:32.785Z] #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965) [task 2018-06-08T07:47:32.785Z] #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad) [task 2018-06-08T07:47:32.785Z] #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad) [task 2018-06-08T07:47:32.785Z] #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716) [task 2018-06-08T07:47:32.785Z] #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716) [task 2018-06-08T07:47:32.785Z] #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a) [task 2018-06-08T07:47:32.785Z] #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a) [task 2018-06-08T07:47:32.785Z] #12 <null> <null> (0x00175c5da6c6) [task 2018-06-08T07:47:32.785Z] [task 2018-06-08T07:47:32.785Z] ThreadSanitizer can not provide additional info. [task 2018-06-08T07:47:32.785Z] SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const [task 2018-06-08T07:47:32.785Z] ==20717==ABORTING [task 2018-06-08T07:47:32.785Z] Exit code: 66 [task 2018-06-08T07:47:32.785Z] FAIL - self-test/assertRecoveredOnBailout-1.js [task 2018-06-08T07:47:32.785Z] TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/self-test/assertRecoveredOnBailout-1.js | ThreadSanitizer:DEADLYSIGNAL (code 66, args "") [0.7 s] [task 2018-06-08T07:47:32.785Z] {"action": "test_start", "jitflags": "", "pid": 20717, "source": "jittests", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528444052.060126} [task 2018-06-08T07:47:32.785Z] {"action": "test_end", "extra": {"jitflags": "", "pid": 20717}, "jitflags": "", "message": "ThreadSanitizer:DEADLYSIGNAL", "pid": 20717, "source": "jittests", "status": "FAIL", "test": "self-test/assertRecoveredOnBailout-1.js", "thread": "main", "time": 1528444052.785573} [task 2018-06-08T07:47:32.785Z] INFO exit-status : 66 [task 2018-06-08T07:47:32.785Z] INFO timed-out : False [task 2018-06-08T07:47:32.786Z] INFO stderr 2> ThreadSanitizer:DEADLYSIGNAL [task 2018-06-08T07:47:32.786Z] INFO stderr 2> ==20717==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a36096 bp 0x7fffffffb690 sp 0x7fffffffb660 T20717) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> ==20717==The signal is caused by a WRITE memory access. [task 2018-06-08T07:47:32.786Z] INFO stderr 2> ==20717==Hint: address points to the zero page. [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #0 js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 (js+0xa36095) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #1 js::jit::RecoverWriter::writeInstruction(js::jit::MNode const*) /builds/worker/workspace/build/src/js/src/jit/Snapshots.cpp:712:14 (js+0xb30479) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #2 js::jit::CodeGeneratorShared::encode(js::jit::LSnapshot*) /builds/worker/workspace/build/src/js/src/jit/shared/CodeGenerator-shared.cpp:579:19 (js+0xb7ca02) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #3 visitEncodeSnapshot /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5070:5 (js+0x7fa810) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #4 js::jit::CodeGenerator::generateBody() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:5793 (js+0x7fa810) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #5 js::jit::CodeGenerator::generate() /builds/worker/workspace/build/src/js/src/jit/CodeGenerator.cpp:10195:10 (js+0x82f965) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #6 GenerateCode /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1870:19 (js+0x866aad) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #7 js::jit::CompileBackEnd(js::jit::MIRGenerator*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:1892 (js+0x866aad) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #8 IonCompile /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2189:19 (js+0x869716) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #9 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*, bool) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2399 (js+0x869716) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #10 BaselineCanEnterAtEntry /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2515:27 (js+0x869c0a) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #11 js::jit::IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/Ion.cpp:2637 (js+0x869c0a) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> #12 <null> <null> (0x00175c5da6c6) [task 2018-06-08T07:47:32.786Z] INFO stderr 2> [task 2018-06-08T07:47:32.786Z] INFO stderr 2> ThreadSanitizer can not provide additional info. [task 2018-06-08T07:47:32.787Z] INFO stderr 2> SUMMARY: ThreadSanitizer: SEGV /builds/worker/workspace/build/src/js/src/jit/Recover.cpp:1887:5 in js::jit::MAssertRecoveredOnBailout::writeRecoverData(js::jit::CompactBufferWriter&) const [task 2018-06-08T07:47:32.787Z] INFO stderr 2> ==20717==ABORTING
It seems that this one is, for some reason, not printing out the assert message.
(In reply to Jan de Mooij [:jandem] from comment #2) > This is brittle. Nicolas, why can't this test just quit(0) instead of > crash()? I don't see what the difference is if the test harness is just > going to ignore these crashes anyway. The test harness does not ignore the result, we expect the test case to crash, with the test case header: // |jit-test| crash Using quit(0), will cause test cases using assertRecoveredOnBailout to be converted to no-op which would not check anything. The suggestion from comment 2 sounds good to me.
Flags: needinfo?(nicolas.b.pierron)
(In reply to Nicolas B. Pierron [:nbp] {backlog: 36} from comment #9) > The suggestion from comment 2 sounds good to me. Except it's not enough cf. comment 6 and following.
Flags: needinfo?(nicolas.b.pierron)
I think adding MOZ_TSAN_BLACKLIST on MOZ_CrashOOL definition should fix this issue, or convert it to Bug 1469910.
Flags: needinfo?(nicolas.b.pierron)
Priority: -- → P3
(In reply to Nicolas B. Pierron [:nbp] {backlog: 39} from comment #11) > I think adding MOZ_TSAN_BLACKLIST on MOZ_CrashOOL definition should fix this > issue, or convert it to Bug 1469910. It only partially does, because not all crashes go through MOZ_CrashOOL. I found another workaround, though.
Blocks: 1478919
Assignee: nobody → mh+mozilla
Comment on attachment 8995427 [details] Bug 1467673 - Disable segfault handling by TSAN when running JIT tests. https://reviewboard.mozilla.org/r/259874/#review266918 If jit-tests are green with this and it doesn't affect TSan otherwise (looks like it doesn't), this LGTM.
Attachment #8995427 - Flags: review?(jdemooij) → review+
Pushed by mh@glandium.org: https://hg.mozilla.org/integration/autoland/rev/060f8e446844 Disable segfault handling by TSAN when running JIT tests. r=jandem
https://hg.mozilla.org/mozilla-central/rev/060f8e446844
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox63: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla63
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: