Closed Bug 1567327 Opened 1 year ago Closed 10 months ago

Assertion failure: !used(), at js/src/jit/Label.h:86 with Baseline Interpreter

Categories

(Core :: JavaScript Engine, defect, P1)

x86_64
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla72
Tracking Status
firefox-esr68 --- unaffected
firefox70 --- wontfix
firefox71 --- wontfix
firefox72 --- fixed

People

(Reporter: gkw, Assigned: jandem)

Details

(4 keywords, Whiteboard: [jsbugmon:update])

Attachments

(4 files)

The following testcase crashes on mozilla-central revision 0b014ee5cd51 (build with --enable-debug --enable-simulator=arm64, run with --fuzzing-safe --wasm-compiler=ion --test-wasm-await-tier2 --no-sse4 --ion-optimization-levels=off --ion-full-warmup-threshold=1500 --ion-instruction-reordering=on --ion-warmup-threshold=0 --ion-check-range-analysis --ion-range-analysis=off --ion-edgecase-analysis=on --ion-osr=off --ion-gvn=off --blinterp --blinterp-eager --more-compartments --no-streams --spectre-mitigations=on --gc-zeal=25,378):

See attachment.

Backtrace:

#0  js::jit::Label::~Label (this=<optimized out>) at js/src/jit/Label.h:86
#1  js::jit::BaselineCodeGen<js::jit::BaselineInterpreterHandler>::emitDebugInstrumentation<js::jit::BaselineCodeGen<js::jit::BaselineInterpreterHandler>::emit_JSOP_RECREATELEXICALENV()::{lambda()#1}, js::jit::BaselineCodeGen<js::jit::BaselineInterpreterHandler>::emit_JSOP_RECREATELEXICALENV()::{lambda()#2}>(js::jit::BaselineCodeGen<js::jit::BaselineInterpreterHandler>::emit_JSOP_RECREATELEXICALENV()::{lambda()#1} const&, mozilla::Maybe<js::jit::BaselineCodeGen<js::jit::BaselineInterpreterHandler>::emit_JSOP_RECREATELEXICALENV()::{lambda()#2}> const&) (this=0x7fa1b78ac5d8, ifDebuggee=..., ifNotDebuggee=...) at js/src/jit/BaselineCompiler.cpp:4983
/snip

For detailed crash information, see attachment.

This is very hard to reproduce and to reduce, most of the time other Assertion failures involving [unhandlable oom] pop up instead. (Be sure to set the top of the testcase to your m-c repo dir) This likely happened after turning on fuzzing Baseline Interpreter, so setting needinfo? from Jan as a start.

Flags: needinfo?(jdemooij)
Attached file Another stack

Another stack with a 32-bit debug deterministic shell build, was run with --fuzzing-safe --wasm-compiler=ion --no-asmjs --ion-full-warmup-threshold=100 --ion-extra-checks --ion-warmup-threshold=0 --ion-range-analysis=off --ion-inlining=off --blinterp --blinterp-eager --blinterp-warmup-threshold=0 --more-compartments --cpu-count=29 --gc-zeal=7,332 --no-native-regexp on m-c rev ca1dbd076e1e

Harmless OOM bug. I'll hold off on this a bit so I can fix it on top of some in-flight patches. Basically in BaselineCodeGen.h we need to use NonAssertingLabel instead of Label and I think addDebugInstrumentationOffset needs to ReportOutOfMemory.

(In reply to Jan de Mooij [:jandem] from comment #4)

Harmless OOM bug. I'll hold off on this a bit so I can fix it on top of some in-flight patches. Basically in BaselineCodeGen.h we need to use NonAssertingLabel instead of Label and I think addDebugInstrumentationOffset needs to ReportOutOfMemory.

Jan, any updates since your comment a month ago?

Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
  • Use NonAssertingLabel in BaselineInterpreterHandler, similar to BaselineCodeGen fields.
  • Make addDebugInstrumentationOffset report OOM.

No test case because the fuzz test is huge and this patch is based on the stack traces.

Priority: -- → P1
Pushed by jdemooij@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/f9a2b4ea4b1f
Fix some OOM issues when generating BaselineInterpreter code. r=iain
Status: ASSIGNED → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla72

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

You need to log in before you can comment on or make changes to this bug.