729899 - IonMonkey: boxed JSFunction of inlined frames should be stored as a constant value in snapshots. (not live in register)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on ionmonkey revision 5a04fd69aa09 (run with --ion -n -m --ion-eager), tested on 64 bit:


var lfcode = new Array();
lfcode.push("function addThis() {}");
lfcode.push("\
var UBound = 0;\
var expectedvalues = [];\
addThis();\
function addThis() {\
  expectedvalues[UBound] = expect;\
  UBound++;\
}\
");
lfcode.push("\
  var expect = 'No Crash';\
  for (var i = 0; i < (2 << 16); i++) addThis();\
");
while (true) {
	var file = lfcode.shift(); if (file == undefined) { break; }
        try { evaluate(file); } catch(lfVare) {}
}

Comment 1

[Christian Holler (:decoder)]

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00000000007d1d95 in js::ion::MachineState::readReg (this=0x7fffffffad40, reg=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonFrames.h:275
275             return regs_[reg.code()];
Missing separate debuginfos, use: debuginfo-install libgcc-4.4.6-3.el6.x86_64 libstdc++-4.4.6-3.el6.x86_64
(gdb) bt
#0  0x00000000007d1d95 in js::ion::MachineState::readReg (this=0x7fffffffad40, reg=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonFrames.h:275
#1  0x00000000007d07b5 in js::ion::SnapshotIterator::fromLocation (this=0x7fffffffacd0, loc=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/Snapshots.cpp:343
#2  0x00000000007d0a43 in js::ion::SnapshotIterator::slotValue (this=0x7fffffffacd0, slot=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/Snapshots.cpp:403
#3  0x0000000000793e1b in js::ion::SnapshotIterator::read (this=0x7fffffffacd0) at ../ion/Snapshots.h:278
#4  0x00000000007931a1 in js::ion::GetPcScript (cx=0xcc6db0, scriptRes=0x7fffffffae50, pcRes=0x7fffffffae48)
    at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonFrames.cpp:436
#5  0x000000000051ab97 in js::types::TypeScript::GetPcScript (cx=0xcc6db0, script=0x7fffffffae50, pc=0x7fffffffae48) at ../jsinferinlines.h:604
#6  0x00000000004ff322 in js::SetObjectElementOperation (cx=0xcc6db0, obj=0x7ffff0910820, id=..., value=...)
    at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/jsinterpinlines.h:805
#7  0x0000000000517e7f in js::SetObjectElement (cx=0xcc6db0, obj=0x7ffff0910820, index=..., value=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/jsinterp.cpp:4604
#8  0x00007ffff7f423ee in ?? ()

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

The bug here is that GetPcScript works by reading safepoint information - it extracts the inlined-most callee out of the stack. But, for out-of-line calls, this could be in a register, and we don't have a MachineRegs available here.

Getting a MachineRegs would not be much work, but bug 728045 will also just fix this, so maybe we should wait for that.

Comment 3

[Paul Wright]

That bug is a resolved duplicate of bug 725357, which has been fixed.

Comment 4

[Nicolas B. Pierron [:nbp]]

The following testcase crashes on ionmonkey revision bf6acad353e0 (run with --ion -n --ion-eager), tested on 86/64 bits linux:

function f2() {
    __proto__ = null;
}

for (var j = 0; j < 50; j++)
    f2();


Identical signature.

Comment 5

[Nicolas B. Pierron [:nbp]]

The problem here comes from the GetPcScript (now InlineFrameReverseIterator::operator++) mechanism used to recover the script of the next inlined frame.

The problem here is that the boxed JSFunction pointer of the inlined frame (which is known at compile time) is still live in a register.  As we know it at compile time, the JSFunction pointer should be a constant value which is part of the snapshot, and not live in a register.

Comment 6

[Nicolas B. Pierron [:nbp]]

Attachment: Mark inlined JSFunction as constant.

Fix and add the 2 test cases reported here.

Comment 7

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/projects/ionmonkey/rev/150159ee5c26

Comment 8

[Nicolas B. Pierron [:nbp]]

Reverted.

Comment 9

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/projects/ionmonkey/rev/fed610aff637

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug729899-1.js.