1586273 - thread '<unnamed>' panicked at 'GPR:%rcx is already free in [ GPR: acd------9------ FPR: 0123456789012345 FLAG: f ]', third_party/rust/cranelift-codegen/src/regalloc/register_set.rs:73:9

Status: RESOLVED DUPLICATE of bug 1586270

(Core :: JavaScript: WebAssembly, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 2e1bfb7458de (build with --enable-valgrind --enable-gczeal --enable-tests --enable-fuzzing --enable-debug --enable-address-sanitizer --disable-jemalloc --enable-optimize=-O2).

Backtrace:

thread '<unnamed>' panicked at 'GPR:%rcx is already free in [ GPR: acd------9------ FPR: 0123456789012345 FLAG: f ]', third_party/rust/cranelift-codegen/src/regalloc/register_set.rs:73:9
stack backtrace:
   0: <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt
   1: core::fmt::write
   2: std::io::Write::write_fmt
   3: std::panicking::default_hook::{{closure}}
   4: std::panicking::default_hook
   5: std::panicking::rust_panic_with_hook
   6: std::panicking::continue_panic_fmt
   7: std::panicking::begin_panic_fmt
   8: cranelift_codegen::regalloc::register_set::RegisterSet::free
             at third_party/rust/cranelift-codegen/src/regalloc/register_set.rs:73
   9: cranelift_codegen::regalloc::solver::Solver::add_live_var
             at third_party/rust/cranelift-codegen/src/regalloc/solver.rs:669
  10: cranelift_codegen::regalloc::solver::Solver::add_through_var
             at third_party/rust/cranelift-codegen/src/regalloc/solver.rs:619
  11: cranelift_codegen::regalloc::coloring::Context::try_add_var
             at third_party/rust/cranelift-codegen/src/regalloc/coloring.rs:1070
  12: cranelift_codegen::regalloc::coloring::Context::iterate_solution
             at third_party/rust/cranelift-codegen/src/regalloc/coloring.rs:1039
  13: cranelift_codegen::regalloc::coloring::Context::visit_inst::{{closure}}
             at third_party/rust/cranelift-codegen/src/regalloc/coloring.rs:564
  14: core::result::Result<T,E>::unwrap_or_else
             at /srv/repos/rust/src/libcore/result.rs:818
  15: cranelift_codegen::regalloc::coloring::Context::visit_inst
             at third_party/rust/cranelift-codegen/src/regalloc/coloring.rs:559
  16: cranelift_codegen::regalloc::coloring::Context::visit_ebb
             at third_party/rust/cranelift-codegen/src/regalloc/coloring.rs:193
  17: cranelift_codegen::regalloc::coloring::Context::run
             at third_party/rust/cranelift-codegen/src/regalloc/coloring.rs:173
  18: cranelift_codegen::regalloc::coloring::Coloring::run
             at third_party/rust/cranelift-codegen/src/regalloc/coloring.rs:152
  19: cranelift_codegen::regalloc::context::Context::run
             at third_party/rust/cranelift-codegen/src/regalloc/context.rs:201
  20: cranelift_codegen::context::Context::regalloc
             at third_party/rust/cranelift-codegen/src/context.rs:328
  21: cranelift_codegen::context::Context::compile
             at third_party/rust/cranelift-codegen/src/context.rs:157
  22: baldrdash::compile::BatchCompiler::compile
             at js/src/wasm/cranelift/src/compile.rs:113
  23: cranelift_compile_function
             at js/src/wasm/cranelift/src/lib.rs:94
  24: _ZN2js4wasm25CraneliftCompileFunctionsERKNS0_17ModuleEnvironmentERNS_9LifoAllocERKN7mozilla6VectorINS0_16FuncCompileInputELm8ENS_17SystemAllocPolicyEEEPNS0_12CompiledCodeEPNS6_9UniquePtrIA_cN2JS10FreePolicyEEE
             at js/src/wasm/WasmCraneliftCompile.cpp:399
  25: _ZL18ExecuteCompileTaskPN2js4wasm11CompileTaskEPN7mozilla9UniquePtrIA_cN2JS10FreePolicyEEE
             at js/src/wasm/WasmGenerator.cpp:728
  26: _ZN2js4wasm15ModuleGenerator25locallyCompileCurrentTaskEv
             at js/src/wasm/WasmGenerator.cpp:775
  27: _ZN2js4wasm15ModuleGenerator14finishFuncDefsEv
             at js/src/wasm/WasmGenerator.cpp:904
  28: _ZL17DecodeCodeSectionIN2js4wasm7DecoderEEbRKNS1_17ModuleEnvironmentERT_RNS1_15ModuleGeneratorE
             at js/src/wasm/WasmCompile.cpp:566
  29: _ZN2js4wasm13CompileBufferERKNS0_11CompileArgsERKNS0_14ShareableBytesEPN7mozilla9UniquePtrIA_cN2JS10FreePolicyEEEPNS7_6VectorISC_Lm0ENS_17SystemAllocPolicyEEEPNSA_25OptimizedEncodingListenerE
             at js/src/wasm/WasmCompile.cpp:589
  30: _ZN2js16WasmModuleObject9constructEP9JSContextjPN2JS5ValueE
             at js/src/wasm/WasmJS.cpp:1170
  [...]

Marking s-s because it looks like a regalloc issue, Cranelift only.

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:
changeset: https://hg.mozilla.org/mozilla-central/rev/20928fb9ac75
parent: 488710:91d88ae893e7
user: Benjamin Bouvier
date: Mon Aug 19 10:46:24 2019 +0000
summary: Bug 1573550: Bump Cranelift to 72b97fcb398537c6bb3ab73c45c428652321cbb6; r=jseward

changeset: https://hg.mozilla.org/mozilla-central/rev/48a97128dbb4
user: Benjamin Bouvier
date: Mon Aug 19 10:22:41 2019 +0000
summary: Bug 1573550: Cranelift: use the Windows calling convention on Windows; r=lth

changeset: https://hg.mozilla.org/mozilla-central/rev/ad5576701625
user: Benjamin Bouvier
date: Mon Aug 19 10:44:56 2019 +0000
summary: Bug 1573550: Pass a null StackmapSink in Cranelift until we implement it; r=jseward

Benjamin, is bug 1573550 a likely regressor?

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Yes, same problem as bug 1586270.