1591598 - Unify LazyScript::enclosingLazyScriptOrScope with JSScript::warmUpData

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P2)

Description

[Ted Campbell [:tcampbell]]

See proposal in https://bugzilla.mozilla.org/show_bug.cgi?id=1529456#c1

We can unify the LazyScript::enclosingLazyScriptOrScope and JSScript::warmUpData fields and move them into js::BaseScript. This reduces the differences between LazyScript and JSScript.

Once a lazy script is compiled, the enclosing scope can be found by looking at enclosing scope of the outermost scope. As a result, the word of memory can be used to store JIT tracking data.

Comment 1

[Ted Campbell [:tcampbell]]

Attachment: Bug 1591598 - Move js::ScriptWarmUpData before js::BaseScript. r?jandem

Prepare to move the warmUpData field to BaseScript by first moving the type
definition earlier in the file.

Comment 2

[Ted Campbell [:tcampbell]]

Attachment: Bug 1591598 - Support storing LazyScript/Scope in ScriptWarmUpData. r?jandem!,jonco!

Allow storing manually-barriered GC pointers in ScriptWarmUpData. This
updates the 'trace' method as needed. When switching types, the user must
first 'clear' the old type and then 'init' the new type. We continue to use
WarmUpCount(0) as the default safe state.

Depends on D55033

Comment 3

[Ted Campbell [:tcampbell]]

Attachment: Bug 1591598 - Move 'warmUpData_' field to js::BaseScript. r?jandem

Unify the JSScript::warmUpData_ and LazyScript::enclosingLazyScriptOrScope_
fields into BaseScript. As a script progresses from lazy up to being JIT-ed
it the type stored in this field will change. If a script is in a compiled
state, the enclosingLazyScriptOrScope_ value can always be reconstructed
during relazification.

Depends on D55034

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/42ca239ee6a6
Move js::ScriptWarmUpData before js::BaseScript. r=jandem
https://hg.mozilla.org/integration/autoland/rev/5ea098cc9ef0
Support storing LazyScript/Scope in ScriptWarmUpData. r=jandem,jonco
https://hg.mozilla.org/integration/autoland/rev/5163670bfede
Move 'warmUpData_' field to js::BaseScript. r=jandem

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/42ca239ee6a6
https://hg.mozilla.org/mozilla-central/rev/5ea098cc9ef0
https://hg.mozilla.org/mozilla-central/rev/5163670bfede

Comment 6

[Cristina Coroiu [:ccoroiu]]

Backed out 7 changesets (bug 1600439, bug 1566466, bug 1591598) for raptor crashes

Backout: https://hg.mozilla.org/integration/autoland/rev/4cb3934b76b14f04d8f8cd781f14a56693312f40

Failure push: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=14f33b78f0eb5e32fd3e9c116f21a23ab7221f26

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=279099999&repo=autoland&lineNumber=829

[task 2019-12-02T17:34:43.940Z] 17:34:43 INFO - raptor-control-server Info: received webext_status: update tab: 2
[task 2019-12-02T17:34:43.942Z] 17:34:43 INFO - raptor-control-server Info: received webext_status: test tab updated: 2
[task 2019-12-02T17:34:43.952Z] 17:34:43 INFO - PID 7936 | console.log: "[raptor-runnerjs] post success"
[task 2019-12-02T17:34:43.952Z] 17:34:43 INFO - PID 7936 | console.log: "[raptor-runnerjs] post success"
[task 2019-12-02T17:52:39.464Z] 17:52:39 CRITICAL - raptor-main Critical: Tests failed to finish! Application timed out.
[task 2019-12-02T17:52:39.465Z] 17:52:39 ERROR - raptor-main Error: Test failed to finish. Application timed out after 1100 seconds
[task 2019-12-02T17:52:39.465Z] 17:52:39 INFO - mozcrash Downloading symbols from: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/PjM4OKf0TKm6B0XbmjcRIQ/artifacts/public/build/target.crashreporter-symbols.zip
[task 2019-12-02T17:52:42.149Z] 17:52:42 INFO - mozcrash Copy/paste: C:\Users\task_1575307310\build\win32-minidump_stackwalk.exe c:\users\task_1575307310\appdata\local\temp\tmpsswfoz.mozrunner\minidumps\c3ee38ba-83a5-4d92-9851-63b46b8fd533.dmp c:\users\task_1575307310\appdata\local\temp\tmpj_zlga
[task 2019-12-02T17:52:47.488Z] 17:52:47 INFO - mozcrash Saved minidump as C:\Users\task_1575307310\build\blobber_upload_dir\c3ee38ba-83a5-4d92-9851-63b46b8fd533.dmp
[task 2019-12-02T17:52:47.488Z] 17:52:47 INFO - mozcrash Saved app info as C:\Users\task_1575307310\build\blobber_upload_dir\c3ee38ba-83a5-4d92-9851-63b46b8fd533.extra
[task 2019-12-02T17:52:47.489Z] 17:52:47 ERROR - PROCESS-CRASH | runner.py | application crashed [@ static class mozilla::Result<mozilla::Ok,JS::TranscodeResult> js::LazyScript::XDRScriptData<js::XDR_ENCODE>(class js::XDRState<js::XDR_ENCODE> *, class JS::Handle<js::ScriptSourceObject *>, class JS::Handle<js::LazyScript *>)]
[task 2019-12-02T17:52:47.490Z] 17:52:47 INFO - Crash dump filename: c:\users\task_1575307310\appdata\local\temp\tmpsswfoz.mozrunner\minidumps\c3ee38ba-83a5-4d92-9851-63b46b8fd533.dmp
[task 2019-12-02T17:52:47.491Z] 17:52:47 INFO - Operating system: Windows NT
[task 2019-12-02T17:52:47.491Z] 17:52:47 INFO - 10.0.15063
[task 2019-12-02T17:52:47.491Z] 17:52:47 INFO - CPU: amd64
[task 2019-12-02T17:52:47.492Z] 17:52:47 INFO - family 6 model 94 stepping 3
[task 2019-12-02T17:52:47.492Z] 17:52:47 INFO - 8 CPUs
[task 2019-12-02T17:52:47.492Z] 17:52:47 INFO - GPU: UNKNOWN
[task 2019-12-02T17:52:47.492Z] 17:52:47 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ
[task 2019-12-02T17:52:47.492Z] 17:52:47 INFO - Crash address: 0x0
[task 2019-12-02T17:52:47.493Z] 17:52:47 INFO - Assertion: Unknown assertion type 0x00000000
[task 2019-12-02T17:52:47.493Z] 17:52:47 INFO - Process uptime: 36 seconds
[task 2019-12-02T17:52:47.493Z] 17:52:47 INFO - Thread 0 (crashed)
[task 2019-12-02T17:52:47.493Z] 17:52:47 INFO - 0 xul.dll!static class mozilla::Result<mozilla::Ok,JS::TranscodeResult> js::LazyScript::XDRScriptData<js::XDR_ENCODE>(class js::XDRState<js::XDR_ENCODE> *, class JS::Handle<js::ScriptSourceObject *>, class JS::Handle<js::LazyScript *>) [JSScript.cpp:14f33b78f0eb5e32fd3e9c116f21a23ab7221f26 : 253 + 0x7]
[task 2019-12-02T17:52:47.493Z] 17:52:47 INFO - rax = 0x0000000000000000 rdx = 0x0000019c0f0576a0
[task 2019-12-02T17:52:47.494Z] 17:52:47 INFO - rcx = 0x00000015bc9fdec0 rbx = 0x0000019c0f0576a0
[task 2019-12-02T17:52:47.494Z] 17:52:47 INFO - rsi = 0x0000019c0f0576a8 rdi = 0x0000019c0f0576f0
[task 2019-12-02T17:52:47.494Z] 17:52:47 INFO - rbp = 0x0000019c0f0576a8 rsp = 0x00000015bc9fde80
[task 2019-12-02T17:52:47.494Z] 17:52:47 INFO - r8 = 0x00000015bc9fdf70 r9 = 0x00000015bc9fe050
[task 2019-12-02T17:52:47.494Z] 17:52:47 INFO - r10 = 0x00000015bc9fe1a0 r11 = 0x0000000000000000
[task 2019-12-02T17:52:47.495Z] 17:52:47 INFO - r12 = 0x0000019c0f0576a0 r13 = 0x0000000000017f49
[task 2019-12-02T17:52:47.495Z] 17:52:47 INFO - r14 = 0x00000015bc9fe020 r15 = 0x00000015bc9fe020
[task 2019-12-02T17:52:47.495Z] 17:52:47 INFO - rip = 0x00007ff8dfd39bab
[task 2019-12-02T17:52:47.495Z] 17:52:47 INFO - Found by: given as instruction pointer in context
[task 2019-12-02T17:52:47.495Z] 17:52:47 INFO - 1 xul.dll!class mozilla::Result<mozilla::Ok,JS::TranscodeResult> js::XDRLazyScript<js::XDR_ENCODE>(class js::XDRState<js::XDR_ENCODE> *, class JS::Handle<js::Scope *>, class JS::Handle<js::ScriptSourceObject *>, class JS::Handle<JSFunction *>, class JS::MutableHandle<js::LazyScript *>) [JSScript.cpp:14f33b78f0eb5e32fd3e9c116f21a23ab7221f26 : 1343 + 0x8]
[task 2019-12-02T17:52:47.496Z] 17:52:47 INFO - rbx = 0x0000019c0f0576a0 rbp = 0x0000019c0f0576a8
[task 2019-12-02T17:52:47.496Z] 17:52:47 INFO - rsp = 0x00000015bc9fdf40 r12 = 0x0000019c0f0576a0
[task 2019-12-02T17:52:47.496Z] 17:52:47 INFO - r13 = 0x0000000000017f49 r14 = 0x00000015bc9fe020
[task 2019-12-02T17:52:47.496Z] 17:52:47 INFO - r15 = 0x00000015bc9fe020 rip = 0x00007ff8dfd398bb
[task 2019-12-02T17:52:47.496Z] 17:52:47 INFO - Found by: call frame info

Comment 7

[Ted Campbell [:tcampbell]]

This is a nullptr crash with BinAST and XDR from the patches in Bug 1600439. The fix is to check for nullptr in LazyScript::XDRScriptData. I'll update the revision and reland the stack.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9a5476cdfaba
Move js::ScriptWarmUpData before js::BaseScript. r=jandem
https://hg.mozilla.org/integration/autoland/rev/bb3d55c2eb05
Support storing LazyScript/Scope in ScriptWarmUpData. r=jandem,jonco
https://hg.mozilla.org/integration/autoland/rev/ab89cd94ef40
Move 'warmUpData_' field to js::BaseScript. r=jandem

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/36d96e39ad22
Move js::ScriptWarmUpData before js::BaseScript. r=jandem
https://hg.mozilla.org/mozilla-central/rev/1f2f66ee6703
Support storing LazyScript/Scope in ScriptWarmUpData. r=jandem,jonco
https://hg.mozilla.org/mozilla-central/rev/7fffe9024632
Move 'warmUpData_' field to js::BaseScript. r=jandem

Comment 10

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/9a5476cdfaba
https://hg.mozilla.org/mozilla-central/rev/bb3d55c2eb05
https://hg.mozilla.org/mozilla-central/rev/ab89cd94ef40