Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp

RESOLVED FIXED in mozilla24

Status

()

--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla24
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [fuzzblocker])

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 744846 [details]
stack

Object.getOwnPropertyNames(this);

asserts js debug shell on m-c changeset da429c311864 with --ion-eager --ion-regalloc=backtracking at Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp

Due to its simplicity, this blocks fuzzing with --ion-regalloc=backtracking
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 1

6 years ago
This testcase WFM on tip.  Does it still crash for you?
Flags: needinfo?(bhackett1024)
(Reporter)

Comment 2

6 years ago
(In reply to Brian Hackett (:bhackett) from comment #1)
> This testcase WFM on tip.  Does it still crash for you?

Yes, it still reproduces on 64-bit non-threadsafe debug non-deterministic js shell on m-c changeset rev e19d0885977c.
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 3

6 years ago
Created attachment 747391 [details] [diff] [review]
patch

OK, got this to repro with Gary's configure options from IRC.  The problematic instruction here was a Concat whose inputs were the same, and which it wanted to be in two different fixed registers.  The backtracking allocator didn't know how to satisfy this.
Assignee: general → bhackett1024
Attachment #747391 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #747391 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 4

6 years ago
Created attachment 749498 [details] [diff] [review]
followup

After fixing this, noticed a couple existing issues where the backtracking allocator was broken.  With these, jit-tests pass with --ion-eager --ion-regalloc=backtracking.
Attachment #749498 - Flags: review?(jdemooij)
Comment on attachment 749498 [details] [diff] [review]
followup

Review of attachment 749498 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/Lowering.cpp
@@ +484,5 @@
>      LFilterArguments *lir = new LFilterArguments(useFixed(string, CallTempReg0),
>                                                   tempFixed(CallTempReg1),
>                                                   tempFixed(CallTempReg2));
>  
> +    return assignSnapshot(lir) && add(lir, ins) && assignSafepoint(lir, ins);

Why does LFilterArguments need a safepoint if it does not use callVM?
(Assignee)

Comment 6

6 years ago
The bailout in LFilterArguments happens after the call it makes, and holds the inputs to the FilterArguments live even though they might have been clobbered.  Those inputs are inputs to the FilterArguments instruction which the regalloc should be able to put in registers.  Using a safepoint causes an OsiPoint instruction after the FilterArguments to hold the inputs used in the bailout, and since the regalloc can't introduce moves between an instruction and its OsiPoint (as enforced by some nasty code in the allocator) this will force those inputs to be in memory.
Attachment #749498 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/3bfbd1ed214d
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
(Reporter)

Updated

5 years ago
Blocks: 826741
You need to log in before you can comment on or make changes to this bug.