846590 - Intermittent jit_test.py --ion-eager | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/basic/bug631305.js: Assertion failure: jumpOffset + SizeOfExtendedJump <= code->instructionsSize(), at /builds/slave/m-in_l64-d_sm-rootanalysis-0

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=20199398&tree=Mozilla-Inbound
Linux x86-64 mozilla-inbound leak test spidermonkey_mozilla-inbound-rootanalysis build on 2013-02-28 14:50:39 PST for push bd745ff1a2e9
slave: bld-linux64-ec2-303

FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/basic/bug631305.js
TEST-UNEXPECTED-FAIL | jit_test.py --ion-eager    | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/basic/bug631305.js: Assertion failure: jumpOffset + SizeOfExtendedJump <= code->instructionsSize(), at /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/ion/x64/Assembler-x64.cpp:65

Comment 1

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=20188686&tree=Mozilla-Inbound
Linux x86-64 mozilla-inbound leak test spidermonkey_mozilla-inbound-rootanalysis build on 2013-02-28 09:39:20
slave: bld-linux64-ec2-654

TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --debugjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args-attributes.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-jm        | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args-createontrace.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --no-jm| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args-attributes.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --ion-eager    | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args-mochi-2.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion       | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args-mutate-length-2.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --debugjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args-mutate-length-2.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --always-mjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args-range-const.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-jm        | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args1.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --ion-eager    | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args1.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion       | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args2.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --always-mjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args2d.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion       | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args8.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --ion-eager    | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/args9.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --always-mjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/argsx-3a.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --debugjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/argsx-3a.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --always-mjit --debugjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/argsx-4.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion       | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/bug508178.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --debugjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/bug554670-2.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --always-mjit| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/bug843985.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
TEST-UNEXPECTED-FAIL | jit_test.py --no-jm        | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/arguments/defaults-scoping.js: Assertion failure: !IsPoisonedPtr<T>(v), at ../../src/js/src/gc/Barrier.h:194
Only displaying first 20 of 100+ failures -
.

Comment 2

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=20264993&tree=Mozilla-Inbound
Linux x86-64 mozilla-inbound leak test spidermonkey_mozilla-inbound-rootanalysis build on 2013-03-02 15:35:19
slave: bld-centos6-hp-013

TEST-UNEXPECTED-FAIL | jit_test.py --ion-eager    | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/ion/bug732864.js: Assertion failure: jumpOffset + SizeOfExtendedJump <= code->instructionsSize(), at /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/ion/x64/Assembler-x64.cpp:65
make: *** [check-jit-test] Error 2

Comment 3

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=20310914&tree=Mozilla-Inbound
Linux x86-64 mozilla-inbound leak test spidermonkey_mozilla-inbound-rootanalysis build on 2013-03-04 12:57:49
slave: bld-linux64-ec2-337

TEST-UNEXPECTED-FAIL | jit_test.py --ion-eager    | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/closures/t021.js: Assertion failure: jumpOffset + SizeOfExtendedJump <= code->instructionsSize(), at /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/ion/x64/Assembler-x64.cpp:65
TEST-UNEXPECTED-FAIL | jit_test.py --ion-eager    | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/debug/Frame-evalWithBindings-02.js: Assertion failure: jumpOffset + SizeOfExtendedJump <= code->instructionsSize(), at /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/ion/x64/Assembler-x64.cpp:65
make: *** [check-jit-test] Error 2

Comment 4

[Steve Fink [:sfink] [:s:]]

Ugh. I ran 1000 iterations of this test in a loop on my local machine, and got 0 errors.

I'll try on my pet slave box next.

Comment 5

[Steve Fink [:sfink] [:s:]]

Attachment: Do not poison when GC suppressed

CheckStackRoots should not do anything when GC is suppressed. This was causing the intermittent orange because an IC compilation would create a new IonCode with GC suppressed. Most of the time, this happened at compile-time and so CheckStackRoots would do nothing because the compartment would have activeAnalysis set. But when generating a runtime IC, it would not be set and the suppressGC flag was not checked.

Currently, my test has made it through 40000 runs without a problem with this patch applied. Before, it would almost always fail in under 1000 runs.

Comment 6

[Terrence Cole [:terrence]]

Comment on attachment 721475 [details] [diff] [review]
Do not poison when GC suppressed

Review of attachment 721475 [details] [diff] [review]:
-----------------------------------------------------------------

Nice find!

Comment 7

[Steve Fink [:sfink] [:s:]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/15aea6ea0f6d

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/15aea6ea0f6d