1851911 - Discarded IC stubs can cause bailout loops

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Iain Ireland [:iain]]

Bug 1803419 is tracking bailout loops being detected in CI. Lukas Bernhard attached a testcase to that bug that triggers the bailout loop assertion intermittently, which I eventually converted to this consistent testcase:

// |jit-test| --fast-warmup; --no-threads; --blinterp-eager

function foo(o) {
  return o.x;
}

function bar(n) {
  with ({}) {}
  class C {}
  for (var i = 0; i < n; i++) {
    var c = new C();
    c.x = 0;
    foo(c);
  }
}

with ({}) {}

function triggerIonCompile() {
  for (var i = 0; i < 10; i++) {
    bar(3);
  }
}

triggerIonCompile();

// Fill up shape list
for (var i = 0; i < 6; i++) {
  bar(10);
}

// Overflow shape list, adding a new baseline IC.
bar(10);

// Discard that IC.
gc();

triggerIonCompile();

My analysis of the original testcase:

We have a class defined inside a function. The constructor for that class calls an initializer function to set the value of x. Inside the initializer, we have an InitProp IC. Because we keep defining new versions of the class, the shape of the object that we see in that IC keeps changing.

The first six shapes create separate ICs. While attaching the seventh, we trigger stub folding, creating a single IC with a GuardMultipleShapes op. At some point we transpile this to Ion. We keep adding new shapes to the GuardMultipleShapes until it hits MaxFoldedShapes (16).

New shapes keep being generated. We bail out of Ion; because the GuardMultipleShapes is full, we attach new stubs for those shapes. Eventually, we've bailed out too often, and we invalidate. Up to this point, everything is working as intended. The IC chain has new stubs in it, so we won't recompile with the same data.

Then we trigger a GC. All the shapes we've generated are dead. We remove the useless stubs. But now the only stub left is the GuardMultipleShapes stub. When we recompile, our IC hash is the same: the address of the folded stub hasn't changed, and it's once again the only stub.

I'm pulling this out into a separate bug, because we were seeing failures in CI (albeit fewer) before Jon landed his patches to remove stubs pointing to dead shapes.

Comment 1

[Iain Ireland [:iain]]

Attachment: Bug 1851911: Disable bailout loop assertion after purging stubs in JitScript::traceWeak r=jandem!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2cbc53cb5d01
Disable bailout loop assertion after purging stubs in JitScript::traceWeak r=jandem

Comment 3

[Cosmin Sabou [:CosminS]]

Backed out for causing bustages on JitScript.h

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=2cbc53cb5d016f9f23f51052aa27db433e25043b&selectedTaskRun=OCNpZI43SC22XxFgbBok6A.0

Failure log:

• https://treeherder.mozilla.org/logviewer?job_id=428460639&repo=autoland
• https://treeherder.mozilla.org/logviewer?job_id=428458080&repo=autoland

Backout link: https://hg.mozilla.org/integration/autoland/rev/92ab27f775e3f8b27570445cc35e1a088739bbe4

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/898b212df77b
Disable bailout loop assertion after purging stubs in JitScript::traceWeak r=jandem

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/898b212df77b