888470 - Assertion failure: target, at ion/x64/Assembler-x64.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming testcase asserts 64-bit threadsafe js debug shell on m-c changeset 942686767e5e with -baseline-eager --ion-parallel-compile=on at Assertion failure: target, at ion/x64/Assembler-x64.cpp

Setting s-s just-in-case, as I don't fully understand this yet, and js::ion::Assembler::addPendingJump being on the stack makes me nervous.

The testcase is fairly intermittent, but I'll see if I can get a bisection range.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: totally unreduced testcase that asserts

This contains full jsfunfuzz code with a set seed.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> changeset 942686767e5e with -baseline-eager --ion-parallel-compile=on at

I meant with --baseline-eager --ion-parallel-compile=on.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:
changeset:   http://hg.mozilla.org/mozilla-central/rev/743204c6b245
user:        Shu-yu Guo
date:        Thu Jun 27 14:47:44 2013 -0700
summary:     Bug 877893 - Part 1: Convert string VM functions needed for concatenation to take ThreadSafeContext. (r=billm)

changeset:   http://hg.mozilla.org/mozilla-central/rev/d6b9e08626e4
user:        Shu-yu Guo
date:        Thu Jun 27 14:47:44 2013 -0700
summary:     Bug 877893 - Part 2: Support string concat in parallel in Ion. (r=djvj)

Shu-yu, is bug 877893 a likely regressor?

Comment 4

[Shu-yu Guo [:shu]]

I can't reproduce this; it looks like somehow when off-thread compiling the string concat stub is NULL?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Shu-yu Guo [:shu] from comment #4)
> I can't reproduce this; it looks like somehow when off-thread compiling the
> string concat stub is NULL?

Try running this multiple times, with at least the following flags:

--enable-threadsafe --enable-debug --enable-optimize

and the following runtime flags:

--baseline-eager --ion-parallel-compile=on

It is also intermittent for me.

Comment 6

[Shu-yu Guo [:shu]]

I've left it in a forever loop for a while now.

Comment 7

[Shu-yu Guo [:shu]]

Is there a machine I can ssh into where this does reproduce?

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Shu-yu has mentioned over IRC that he has been able to reproduce on his machine.

Comment 9

[Shu-yu Guo [:shu]]

Attachment: fix

Forgot to sweep the parallelStringConcat_ stub if not marked.

Comment 12

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/63be52acb2fd

try: https://tbpl.mozilla.org/?tree=Try&rev=dcc924a0d06e

Comment 13

[Christian Holler (:decoder)]

This can lead to arbitrary code execution.

Comment 14

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/63be52acb2fd