832437 - Assertion failure: &entry == &stack->mStack[stack->stackSize() - 1], at tools/profiler/TableTicker.cpp:747

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[:Irving Reid (No longer working on Firefox)]

Attachment: OS X process state dump after crash

Debug nightly build, with all profiling enabled; browser was in the background but had recently launched a tab containing http://www.marriedtothesea.com/archives/2006/Feb/

In a similar location to bug 776025, but I'm not certain they're related.

The crash was not recorded in about:crashes.

Comment 1

[Jan de Mooij [:jandem]]

I'm working on enabling TI and IonMonkey for chrome and we hit this crash on Try, in Mochitest-BC:

https://tbpl.mozilla.org/?tree=Try&rev=ab22d82dc5b5

It seems Linux Debug only and so far I'm unable to reproduce it locally. BenWa, any idea what's going on here? Any pointers on how to debug this (on Try)?

This is the last issue blocking bug 929374.

Comment 2

[Benoit Girard (:BenWa)]

When the JS engine pushes a js frame to the pseudostack it doesn't have to fill in the JSPC until it pushes another js frame pseudostack. This assertion is catching that a js frame on the pseudostack should but doesn't have a js pc.

My advice is to get this to reproduce locally instead of Try. I know irving hit it a few times but most people don't profile with debug builds (because the performance numbers are off) so these assertion are often missed.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

I added some extra debug checks, then ran all JIT tests with the SPS profiler + extra assertions enabled.

This caught some problems where we could have JS frames with a NullPCIndex. This patch fixes them.

And indeed, I have 5 beautiful green b-c runs now with Ion and TI enabled for chrome, yay: https://tbpl.mozilla.org/?tree=Try&rev=c641fd52bec4

Comment 4

[Kannan Vijayan [:djvj]]

Comment on attachment 8374815 [details] [diff] [review]
Patch

Review of attachment 8374815 [details] [diff] [review]:
-----------------------------------------------------------------

Ah, VM calls from Ion ICs.  Nice job tracking this down.

Comment 5

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3b75dbacf83e

Green on Linux x64: https://tbpl.mozilla.org/?tree=Try&rev=c641fd52bec4

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3b75dbacf83e