TI: Assertion failure: m_pools.empty(), at ./assembler/jit/ExecutableAllocator.h:180

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 532025 [details]
shell testcase, unpack, chdir and run main.js with options "-j -n -m -a"

The attached testcase asserts on TI revision 09461ee64436 (run with -j -m -n -a),
tested on 64 bit. This is another very fragile test.
(Reporter)

Comment 1

6 years ago
Stack trace:

Assertion failure: m_pools.empty(), at ./assembler/jit/ExecutableAllocator.h:180
[New Thread 0x7f956855b720 (LWP 26763)]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7f956855b720 (LWP 26763)]
0x00007f956814f7bb in raise () from /lib/libpthread.so.0
(gdb) bt
#0  0x00007f956814f7bb in raise () from /lib/libpthread.so.0
#1  0x00000000005cc9c8 in JS_Assert (s=0x7bde3b "m_pools.empty()", file=0x7bddf0 "./assembler/jit/ExecutableAllocator.h", ln=180)
    at /home/decoder/LangFuzz/jaegermonkey/js/src/jsutil.cpp:89
#2  0x000000000046f555 in ~ExecutableAllocator (this=0x2091120) at ./assembler/jit/ExecutableAllocator.h:180
#3  0x000000000046fb17 in js::Foreground::delete_<JSC::ExecutableAllocator> (p=0x2091120) at ./jsutil.h:498
#4  0x00000000006907ed in js::mjit::JaegerCompartment::Finish (this=0x2091080) at /home/decoder/LangFuzz/jaegermonkey/js/src/methodjit/MethodJIT.cpp:847
#5  0x000000000046f58c in ~JaegerCompartment (this=0x2091080) at /home/decoder/LangFuzz/jaegermonkey/js/src/methodjit/MethodJIT.h:361
#6  0x000000000046fb44 in js::Foreground::delete_<js::mjit::JaegerCompartment> (p=0x2091080) at /home/decoder/LangFuzz/jaegermonkey/js/src/jsutil.h:498
#7  0x000000000046cd78 in ~JSCompartment (this=0x2036dd0) at /home/decoder/LangFuzz/jaegermonkey/js/src/jscompartment.cpp:103
#8  0x00000000004c2ce7 in JSContext::delete_<JSCompartment> (this=0x2036880, p=0x2036dd0) at /home/decoder/LangFuzz/jaegermonkey/js/src/jscntxt.h:1318
#9  0x00000000004bafc5 in SweepCompartments (cx=0x2036880, gckind=GC_LAST_CONTEXT) at /home/decoder/LangFuzz/jaegermonkey/js/src/jsgc.cpp:2238
#10 0x00000000004bb769 in MarkAndSweep (cx=0x2036880, comp=0x0, gckind=GC_LAST_CONTEXT) at /home/decoder/LangFuzz/jaegermonkey/js/src/jsgc.cpp:2425
#11 0x00000000004bb9fa in GCCycle (cx=0x2036880, comp=0x0, gckind=GC_LAST_CONTEXT) at /home/decoder/LangFuzz/jaegermonkey/js/src/jsgc.cpp:2674
#12 0x00000000004bbbd8 in js_GC (cx=0x2036880, comp=0x0, gckind=GC_LAST_CONTEXT) at /home/decoder/LangFuzz/jaegermonkey/js/src/jsgc.cpp:2745
#13 0x0000000000467e74 in js_DestroyContext (cx=0x2036880, mode=JSDCM_FORCE_GC) at /home/decoder/LangFuzz/jaegermonkey/js/src/jscntxt.cpp:655
#14 0x000000000042a355 in JS_DestroyContext (cx=0x2036880) at /home/decoder/LangFuzz/jaegermonkey/js/src/jsapi.cpp:1034
#15 0x0000000000411acd in DestroyContext (cx=0x2036880, withGC=true) at /home/decoder/LangFuzz/jaegermonkey/js/src/shell/js.cpp:5824
#16 0x00000000004122a2 in main (argc=5, argv=0x7fff55ac0a50, envp=0x7fff55ac0a80) at /home/decoder/LangFuzz/jaegermonkey/js/src/shell/js.cpp:6107
If we recompile a frame from inside a native stub (either the native itself or SplatApplyArgs), we orphan the stub until the call finishes and we rejoin to the interpoline.  If the native throws, we rejoined to the throwpoline instead, which didn't release the pool reference and leaked it.  The fix has us check for a reference to the orphaned pools in both the interpoline and throwpoline.

http://hg.mozilla.org/projects/jaegermonkey/rev/ef1ce31f66b9
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 3

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/recompile/bug656753.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.