821216 - Assertion failure: state.numThreads

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

1. http://www.iplt20.com/match/2012/7 plus several other urls so far.
2. Assertion failure: state.numThreads, at c:/work/mozilla/builds/nightly/mozilla/js/src/jsworkers.cpp:41

The assertion was added by bhackett in bug 774253

Found regression between 20121210134422-20121211210657
Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4dfe323a663d&tochange=553a3bcf1fe7
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/12/2012-12-11-mozilla-central-debug/firefox-20.0a1.en-US.debug-win32.installer.exe
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/12/2012-12-12-mozilla-central-debug/firefox-20.0a1.en-US.debug-win32.installer.exe

Lots of check ins there. I'll try to narrow it down when I have some time.


Windows XP/7 Nightly so far. Doesn't crash Nightly opt build from 12/1. Not Beta or Aurora though they do show different crashes/assertions.

Operating system: Windows NT
                  5.1.2600 Service Pack 3
CPU: x86
     GenuineIntel family 6 model 37 stepping 1
     1 CPU

Crash reason:  EXCEPTION_BREAKPOINT
Crash address: 0xd77be1

Thread 0 (crashed)
 0  mozjs.dll!js::StartOffThreadIonCompile(JSContext *,js::ion::IonBuilder *) [jsworkers.cpp : 41 + 0x1d]
    eip = 0x00d77be1   esp = 0x0012c354   ebp = 0x0012c36c   ebx = 0x0e989460
    esi = 0x07ea0340   edi = 0x07e9a5e0   eax = 0x00000000   ecx = 0x69f37d44
    edx = 0x10362ee8   efl = 0x00200212
    Found by: given as instruction pointer in context
 1  mozjs.dll!js::ion::SequentialCompileContext::compile(js::ion::IonBuilder *,js::ion::MIRGraph *,js::ion::AutoDestroyAllocator &) [Ion.cpp : 1190 + 0xc]
    eip = 0x0100c90b   esp = 0x0012c374   ebp = 0x0012c398
    Found by: call frame info
 2  mozjs.dll!js::ion::IonCompile<js::ion::SequentialCompileContext> [Ion.cpp : 1158 + 0x13]
    eip = 0x010132f0   esp = 0x0012c3a0   ebp = 0x0012c434
    Found by: call frame info
 3  mozjs.dll!js::ion::TestIonCompile(JSContext *,JSScript *,JSFunction *,unsigned char *,bool) [Ion.cpp : 1220 + 0x1d]
    eip = 0x0100ca32   esp = 0x0012c43c   ebp = 0x0012c458
    Found by: call frame info
 4  mozjs.dll!js::mjit::stubs::TriggerIonCompile(js::VMFrame &) [StubCalls.cpp : 837 + 0x3b]
    eip = 0x00ed4d71   esp = 0x0012c460   ebp = 0x0012c48c
    Found by: call frame info
 5  mozjs.dll!js::mjit::EnterMethodJIT(JSContext *,js::StackFrame *,void *,JS::Value *,bool) [MethodJIT.cpp : 1039 + 0x14]
    eip = 0x00ecc025   esp = 0x0012c4e4   ebp = 0x0012c4cc
    Found by: call frame info with scanning
 6  mozjs.dll!CheckStackAndEnterMethodJIT [MethodJIT.cpp : 1097 + 0x19]
    eip = 0x00ecc5f7   esp = 0x0012c584   ebp = 0x0012c55c
    Found by: call frame info with scanning

Comment 1

[Brian Hackett [Laid off!]]

Attachment: don't compile off thread on single core machines

This assertion is unrelated to the site being visited, but rather to your configuration.  I'm going to guess that this assertion is being generated on a machine with only a single core available.  We don't want to do off thread compilation in this case, but are only checking that in shells rather than the browser.

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7cfc4ad935b1

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7cfc4ad935b1