454145 - v8/raytrace.js down to 10 aborts, all MISMATCH_EXIT from nested tree

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, enhancement, P3)

Description

[Brendan Eich [:brendan]]

Here's the spew. Not much in the nested tree execution, but callprop seems to side-exit with a mismatch. That sounds like shape guard mismatch. We had hoped to make those guards use BRANCH_EXIT, but that will take some doing on the other side of the side-exit, where we attach traces to trees. Guidance welcome.

/be

Breakpoint 2, js_RecordLoopEdge (cx=0x1100b10, r=0x113a6d0, oldpc=0x1119a9c "\b??V", inlineCallCount=@0xbfffdba0) at jstracer.cpp:2169
2169            GuardRecord* lr = js_ExecuteTree(cx, &f, inlineCallCount, &innermostNestedGuard);
(gdb) n
entering trace at raytrace.js:3199@39, native stack slots: 38 code: 0x61195a
global: object<0x4cdc00:Object> object<0x4cc620:Math> 
stack: callee0=object<0x4cf348:Function> this0=object<0x4ccf40:Object> argv0=object<0x4f5200:Object> argv1=object<0x4cc4e0:Object> argv2=object<0x4ccd40:Object> vars0=int<0> vars1=object<0x4f5240:Object> vars2=int<0> vars3=vars4=
leaving trace at raytrace.js:3202@65, op=callprop, lr=0x612d8c, exitType=3, sp=1, ip=0x612d87, cycles=27324
object<0x4cdc00:Object> object<0x4cc620:Math> object<0x4cdc00:Object> object<0x4cc620:Math> 
object<0x4cf348:Function> object<0x4ccf40:Object> object<0x4f5200:Object> object<0x4cc4e0:Object> object<0x4ccd40:Object> object<0x4f5240:Object> object<0x4ccac0:Object> object<0x0:null> object<0x4ccac0:Object> callee0=object<0x4cf348:Function> this0=object<0x4ccf40:Object> argv0=object<0x4f5200:Object> argv1=object<0x4cc4e0:Object> argv2=object<0x4ccd40:Object> vars0=int<0> vars1=object<0x4f5240:Object> vars2=int<1> vars3=object<0x4ccac0:Object> vars4=object<0x0:null> stack0=object<0x4ccac0:Object> 
2170            if (!lr) {
(gdb) p *lr
$6 = {
  target = 0x0, 
  from = 0x11009c0, 
  jmp = 0x612d87, 
  origTarget = 0x0, 
  exit = 0x605b34, 
  outgoing = 0x612dcc, 
  next = 0x0, 
  guard = 0x605b68, 
  calldepth = 0, 
  compileNbr = 0, 
  sid = 0
}
(gdb) p *$.exit
$7 = {
  ip_adj = 26, 
  sp_adj = 8, 
  rp_adj = 0, 
  target = 0x0, 
  from = 0x11009c0, 
  calldepth = 0, 
  numGlobalSlots = 1, 
  numStackSlots = 11, 
  numStackSlotsBelowCurrentFrame = 0, 
  typeMap = 0x605b24 "", 
  exitType = MISMATCH_EXIT, 
  sid = 0
}
(gdb) p *$6.guard
$8 = {
  {
    u = {
      code = LIR_xf, 
      oprnd_3 = 0, 
      oprnd_1 = 17, 
      oprnd_2 = 0
    }, 
    c = {
      code = LIR_xf, 
      resv = 0, 
      imm8a = 17, 
      imm8b = 0
    }, 
    i = {
      code = LIR_xf, 
      resv = 0, 
      imm16 = 17
    }, 
    t = {
      code = LIR_xf, 
      imm24 = 4352
    }, 
    g = {
      code = LIR_xf, 
      resv = 0, 
      unused = 17
    }, 
    sti = {
      code = LIR_xf, 
      disp = 0, 
      oprnd_1 = 17, 
      oprnd_2 = 0
    }
  }
}

Comment 1

[Brendan Eich [:brendan]]

Line from the spew that matters:

leaving trace at raytrace.js:3202@65, op=callprop, lr=0x612d8c, exitType=3,
sp=1, ip=0x612d87, cycles=27324

Line 3202 of raytrace.js is:

                var info = shape.intersect(ray);

in

    testIntersection: function(ray, scene, exclude){

so intersect has been inlined up to pc 65. The only intersect candidate is

    intersect: function(ray){
        var info = new Flog.RayTracer.IntersectionInfo();
        info.shape = this; 
                    
        var dst = Flog.RayTracer.Vector.prototype.subtract(ray.position, this.position);
            
        var B = dst.dot(ray.direction);
        var C = dst.dot(dst) - (this.radius * this.radius);
        var D = (B * B) - C;
    
        if(D > 0){ // intersection!
            info.isHit = true;
            info.distance = (-B) - Math.sqrt(D);
            info.position = Flog.RayTracer.Vector.prototype.add(
                                                ray.position, 
                                                Flog.RayTracer.Vector.prototype.multiplyScalar(
                                                    ray.direction,
                                                    info.distance
                                                )
                                            );
            info.normal = Flog.RayTracer.Vector.prototype.subtract(
                                            info.position,
                                            this.position                                        ).normalize();
        
            info.color = this.material.getColor(0,0);
        } else {
            info.isHit = false;
        }
        return info;
    },

and pc 65 and its dependencies and dependent store are:

;-------------------------   6:
;-------------------------   7:     var B = dst.dot(ray.direction);
00054:   7  getlocal 1
00057:   7  callprop "dot"
00060:   7  getargprop 0 "direction"
00065:   7  call 1
00068:   7  setlocal 2
00071:   7  pop

Gotta sleep, more tomorrow.

/be

Comment 2

[Andreas Gal :gal]

You can make it BRANCH_EXIT and it should attach correctly, just make sure we actually handle all possible scenarios in such a case. So if you have some callprop implementation make sure all cases are captured, otherwise don't return BRANCH_EXIT or we will keep attaching traces there over and over as we don't compile the code right and next time around side-exit again.

Comment 3

[Brendan Eich [:brendan]]

Running into bug 445899 (a regression from bug 445899). Will fix that and then I believe v8/raytrace.js will be abort-free.

/be

Comment 4

[Brendan Eich [:brendan]]

(In reply to comment #3)
> Running into bug 445899

er, bug 454266.

> (a regression from bug 445899). Will fix that and then
> I believe v8/raytrace.js will be abort-free.
> 
> /be

Comment 5

[Brendan Eich [:brendan]]

Attachment: fix, but it exposes bug 453730 badness

The lack of full arguments object support (bug 453730) crashes v8/raytrace.js. Recording this for posterity, looking for review but I won't land until 453730 is fixed.

/be

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 337938 [details] [diff] [review]
fix, but it exposes bug 453730 badness

This is crashing t/3d-raytrace.js -- need to de-prioritize for now.

/be

Comment 7

[Guilherme Lima]

Maybe this bug can be fixed now? The 'blocker' has been fixed a long time ago.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Obsolete with the removal of tracejit.