1954129 - Error during inference using the demo extension and a debug build

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[William Durand [:willdurand]]

STR:

1. Start a Firefox debug build
2. Follow the steps to install the demo extension: https://firefox-source-docs.mozilla.org/toolkit/components/ml/extensions-api-example/README.html#installation
3. Try to generate an alt text for the first large image in https://www.mozilla.org/en-US/privacy/firefox/

Expected:

Alt text is generated.

Actual:

The extension doesn't generate an alt text. The extension UI (injected in the page) is stuck at the "Running inference..." phase.

It looks like the inference process crashes but I am not sure. I don't see the process in about:processes. I do see a stack trace in my terminal, though:

#01: js::wasm::CallSites::operator[](unsigned long) const[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e3f89c]
#01: js::wasm::CallSites::operator[](unsigned long) const[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e3f89c]
#02: js::wasm::CallSites::lookup(unsigned int, js::wasm::CallSite*) const[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e3a0ac]
#02: js::wasm::CallSites::lookup(unsigned int, js::wasm::CallSite*) const[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e3a0ac]
#03: js::wasm::GetNearestEffectiveInstance(js::wasm::Frame const*)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e5c1b4]
#03: js::wasm::WasmFrameIter::popFrame()[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e62f84]
#04: js::wasm::WasmFrameIter::WasmFrameIter(js::jit::JitActivation*, js::wasm::Frame*)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e6269c]
#04: js::JitFrameIter::operator++()[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6ccfe4c]
#05: js::FrameIter::popJitFrame()[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6cd0d70]
#05: js::FrameIter::settleOnActivation()[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6cd016c]
#06: js::FrameIter::operator++()[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6cd0980]
#06: js::FrameIter::FrameIter(JSContext*, js::FrameIter::DebuggerEvalOption)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6cd084c]
#07: JSContext::handleInterrupt()[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6ebdc58]
#07: JSContext::handleInterrupt()[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6ebdc34]
#08: js::FutexThread::wait(JSContext*, js::LockGuard<js::Mutex>&, mozilla::Maybe<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>> const&)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6b6f750]
#08: js::FutexThread::wait(JSContext*, js::LockGuard<js::Mutex>&, mozilla::Maybe<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>> const&)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6b6f750]
#09: js::atomics_wait_impl(JSContext*, js::SharedArrayRawBuffer*, unsigned long, int, mozilla::Maybe<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>> const&)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6b6ead8]
#09: js::atomics_wait_impl(JSContext*, js::SharedArrayRawBuffer*, unsigned long, int, mozilla::Maybe<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>> const&)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6b6ead8]
#10: js::wasm::Instance::wait_i32_m32(js::wasm::Instance*, unsigned int, int, long long, unsigned int)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e87650]
#10: js::wasm::Instance::wait_i32_m32(js::wasm::Instance*, unsigned int, int, long long, unsigned int)[/Users/william/projects/mozilla/worktrees/gecko-2/objdir-desktop-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7e87650]

Comment 1

[Tarek Ziadé (:tarek)]

notice that some other images do work

Comment 2

[Tarek Ziadé (:tarek)]

(and works in non debug builds)

Comment 3

[Ryan Hunt [:rhunt]]

This seems like a potential dupe of bug 1944056. It seems like with interrupts we can end up violating a hash maps re-entrancy guard. This is likely safe because they should be just reads (not read-writes). But I'll need to reproduce locally to confirm because the crash stack isn't giving the full picture.

Comment 4

[Ryan Hunt [:rhunt]]

Attachment: Bug 1954129 - wasm: Fix hash map lookups for Code to be read-only. r?yury

StackMaps, CallSites, and TrapSites all have hash maps on them. These are
used from multiple different threads at the same time, which can lead to
assertions in ReentrancyGuard. This is safe, because all of these classes
are actually read-only after they are constructed and lookups start
happening. Switch to a readOnlyThreadSafeLookup instead. This only
effects debug builds.

Comment 5

[Ryan Hunt [:rhunt]]

The attached patch fixes the issue for me locally.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/47418076ff7c
wasm: Fix hash map lookups for Code to be read-only. r=yury

Comment 8

[amarc]

https://hg.mozilla.org/mozilla-central/rev/47418076ff7c