824205 - static JS_ALWAYS_INLINE void does not compile on N9 harmattan sbox environment

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Oleg Romashin (:romaxa)]

c++ -o CodeGenerator.o -c  -fvisibility=hidden -DENABLE_TYPEDARRAY_MOVE -DENABLE_YARR_JIT=1 -DMOZ_GLUE_IN_PROGRAM -DNO_NSPR_10_SUPPORT -DEXPORT_JS_API -DJS_HAS_CTYPES -DDLL_PREFIX=\"lib\" -DDLL_SUFFIX=\".so\" -DUSE_ZLIB -Ictypes/libffi/include -I.  -Ijs/src/../../mfbt/double-conversion -Ijs/src -I. -I./../../dist/include  -Iobj-build-n9-hm/dist/include/nspr      -Ijs/src -Ijs/src/assembler -Ijs/src/yarr  -fPIC  -pedantic -Wall -Wpointer-arith -Woverloaded-virtual -Werror=return-type -Wtype-limits -Wempty-body -Wno-ctor-dtor-privacy -Wno-overlength-strings -Wno-invalid-offsetof -Wno-variadic-macros -Wno-long-long -ffunction-sections -fdata-sections -fno-exceptions -pthread -pipe  -DNDEBUG -DTRIMMED -gdwarf-2 -O3 -freorder-blocks  -fomit-frame-pointer -DUSE_SYSTEM_MALLOC=1 -DENABLE_ASSEMBLER=1 -DENABLE_JIT=1   -DMOZILLA_CLIENT -include ./js-confdefs.h -MD -MF .deps/CodeGenerator.o.pp  js/src/ion/CodeGenerator.cpp
In file included from js/src/ion/shared/IonAssemblerBufferWithConstantPools.h:10,

c++ -o CodeGenerator.o -c  -fvisibility=hidden -DENABLE_TYPEDARRAY_MOVE -DENABLE_YARR_JIT=1 -DMOZ_GLUE_IN_PROGRAM -DNO_NSPR_10_SUPPORT -DEXPORT_JS_API -DJS_HAS_CTYPES -DDLL_PREFIX=\"lib\" -DDLL_SUFFIX=\".so\" -DUSE_ZLIB -Ictypes/libffi/include -I.  -Ijs/src/../../mfbt/double-conversion -Ijs/src -I. -I./../../dist/include  -Iobj-build-n9-hm/dist/include/nspr      -Ijs/src -Ijs/src/assembler -Ijs/src/yarr  -fPIC  -pedantic -Wall -Wpointer-arith -Woverloaded-virtual -Werror=return-type -Wtype-limits -Wempty-body -Wno-ctor-dtor-privacy -Wno-overlength-strings -Wno-invalid-offsetof -Wno-variadic-macros -Wno-long-long -ffunction-sections -fdata-sections -fno-exceptions -pthread -pipe  -DNDEBUG -DTRIMMED -gdwarf-2 -O3 -freorder-blocks  -fomit-frame-pointer -DUSE_SYSTEM_MALLOC=1 -DENABLE_ASSEMBLER=1 -DENABLE_JIT=1   -DMOZILLA_CLIENT -include ./js-confdefs.h -MD -MF .deps/CodeGenerator.o.pp  js/src/ion/CodeGenerator.cpp
In file included from js/src/ion/shared/IonAssemblerBufferWithConstantPools.h:10,

./../../dist/include/js/Utility.h: In member function 'js::ion::IonScriptCounts* js::ion::CodeGenerator::maybeCreateScriptCounts()':
./../../dist/include/js/Utility.h:500: sorry, unimplemented: inlining failed in call to 'void js_delete(T*) [with T = js::ion::IonScriptCounts]': recursive inlining
js/src/ion/IonCode.h:534: sorry, unimplemented: called from here
js/src/ion/RegisterSets.h: In member function 'js::ion::ConstantOrRegister js::ion::CodeGenerator::getSetPropertyValue(js::ion::LInstruction*)':
js/src/ion/RegisterSets.h:221: warning: dereferencing pointer '<anonymous>' does break strict-aliasing rules
./../../dist/include/mozilla/Util.h:137: note: initialized from here
js/src/ion/RegisterSets.h:168: warning: derefe

removing JS_ALWAYS_INLINE fixes the problem

Comment 1

[Jeff Walden [:Waldo]]

~IonScriptCounts includes a call to js_delete(IonScriptCounts*) in it, for the previous field in that struct.  So you have recursive deletion from one script-count, into the previous one for it, and so on until it bottoms out when the last is hit (and its previous is null).  No idea what would start triggering this now, exactly, but clearly we shouldn't be having a destructor that can recur like that -- destruction needs to be iterative somehow, because the inliner hasn't been taught to flatten the recursion into an iterative process.

That's all I've got for now, maybe someone else can see how to do that now -- it's too late here for me to think much more deeply than this.

Comment 2

[Oleg Romashin (:romaxa)]

Attachment: static JS_ALWAYS_INLINE void fail to build

Quick workaround