453563 - TM: assertion when running unit tests with the JIT on

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Due to a mistake in my first merge, we had been running the unit tests with the JIT on. There has been a regression on the TraceMonkey branch (recently merged back to mozilla-central) which causes us to hit:

#3  0x4014d3bd in JS_Assert (
    s=0x401e5e30 "(traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1]", 
    file=0x401e510c "/home/mrbkap/work/tm-browser/mozilla/js/src/jstracer.cpp", ln=1398)
    at /home/mrbkap/work/tm-browser/mozilla/js/src/jsutil.cpp:58

from

#4  0x40170a7a in TraceRecorder::snapshot (this=0x832c778, exitType=nanojit::MISMATCH_EXIT)
    at /home/mrbkap/work/tm-browser/mozilla/js/src/jstracer.cpp:1391

We should figure out what regressed and fix it. Perhaps when we do fix it, we can purposely (and correctly) turn the JIT back on for unittests.

The assertion happens during shutdown during the extensionmanager tests (testable by running 'make check' from <objdir>/toolkit/mozapps/).

Comment 1

[Brendan Eich [:brendan]]

This is because of global objects changing as function calls inline across static scope boundaries. Blake, were you gonna take this? Or is there another bug that is a dup of it, already on your list? I could not find one by searching, but bugzilla search frustrates me.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix, pro tem

This is the right short-term fix to cure crashes and assertbotches -- tracing across globals requires nested recorders and tracemonitor refactoring.

/be

Comment 3

[Andreas Gal :gal]

I would suggest we intern only globals from the frame we start it. Other globals we access via a slow path and some builtins. So if currentGlobal != globalObj then read & unbox.

Comment 4

[Brendan Eich [:brendan]]

I filed bug 454739 for the better fix, please comment there (note that a guard snapshot may see the wrong global scoping the top frame's function). Waiting for green to commit this bug's workaround patch.

/be

Comment 5

[Brendan Eich [:brendan]]

Fixed:

http://hg.mozilla.org/tracemonkey/rev/f66159540713
http://hg.mozilla.org/mozilla-central/rev/54b9017577ea

/be

Comment 7

[Bob Clary [:bc] (inactive)]

covered by unittests