1603920 - Assertion failure: Mismatch between stored lastProfilingFrame and current stack pointer., at js/src/jit/MacroAssembler.cpp:1828 with Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision a6b449010a04 (build with --enable-debug --disable-optimize, run with --fuzzing-safe --no-threads --baseline-eager --no-ion):

// jsfunfuzz-generated
enableGeckoProfiling();
// Adapted from randomly chosen test: js/src/jit-test/tests/debug/onEnterFrame-generator-08.js
let g = newGlobal({
    newCompartment: true
});
g.eval("function* f() {}");
let dbg = new Debugger(g);
let it = g.f();
dbg.onEnterFrame = () => ({
    return: "exit"
});
it.throw();

Backtrace:

#0  0x000017c75d236d39 in ?? ()
#1  0x000017c75d21a785 in ?? ()
#2  0x0000000000001044 in ?? ()
#3  0x0000216f622ac830 in ?? ()
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Pernosco link:

https://pernos.co/debug/Exh7PUZKpPooX8lN72Dnfg/index.html

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/467644cd89e8
user: Jan de Mooij
date: Sat Jul 13 11:21:12 2019 +0000
summary: Bug 1564017 part 7 - Enable the Baseline Interpreter in the browser. r=tcampbell

Jan, is baseline interpreter a likely regressor?

Comment 4

[Jan de Mooij [:jandem]]

Bug 1602699 is refactoring some of this code, I'll wait for that to land and investigate (if it's still an issue then).

Comment 5

[Jan de Mooij [:jandem]]

Gary, does this still repro for you? The test seems to pass for me now but I didn't do a lot of testing.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first good revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/b2ad424d4882
user: Logan Smyth
date: Thu Dec 19 00:57:00 2019 +0000
summary: Bug 1602699 - Part 5: Change DebugAPI::onEnter/ResumeFrame to work via an error. r=jimb,jandem

Logan, is bug 1602699 a likely fix?

Comment 7

[Logan Smyth [:loganfsmyth]]

Yep, https://bugzilla.mozilla.org/show_bug.cgi?id=1602699 almost certainly fixed this.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Resolving fixed by bug 1602699 as per comment 6 and comment 7.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Should we land this testcase still? I don't see any new tests added by bug 1602699.

Comment 10

[Logan Smyth [:loganfsmyth]]

I'm not sure it's necessary. The code path that was triggering this case was, I think, missing a piece of code for gecko profiler cleanup of the function call, causing some kind of failure here. https://bugzilla.mozilla.org/show_bug.cgi?id=1602699 removed that codepath entirely in favor of the path already used everywhere in the system, so existing tests for the profile should already cover the code now being used.