903028 - Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

ParallelArray([5477], function() {
    Array(function() {})
})

asserts js 64-bit debug threadsafe shell on m-c changeset fd4cf30428b0 with --ion-parallel-compile=on at Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp

gc seems to be on the stack so setting s-s for now. Running autoBisect, tested on Windows 7. Assuming related to ParallelArrays for now.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Shu-yu Guo [:shu]]

I can't reproduce this on Linux, but from the stack trace it's crashing due to the read barrier on TypeObject in OMTC when trying to make a new singleton type set for MLambdaPar.

ParallelArraySafetyAnalysis might make new MIR nodes to replace unsafe ones. If OMTC is on, this happens off thread.

I'm not really sure what's allowed/not allowed for OMTC, needinfo'ing bhackett.

Comment 3

[Shu-yu Guo [:shu]]

Attachment: bug903028-omtc-safetyanalysis-alloc.patch

This patch reuses existing type sets and so doesn't allocate any new type sets OMT. Not sure if this is the right fix, though.

Also not sure if it fixes the crash since I can't reproduce it. Gary, could you check?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(fwiw, I could repro this on 64-bit debug Windows, but I'll retest your patch tomorrow)

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 787805 [details] [diff] [review]
bug903028-omtc-safetyanalysis-alloc.patch

This patch does seem to fix the issue.

Comment 6

[Shu-yu Guo [:shu]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> Comment on attachment 787805 [details] [diff] [review]
> bug903028-omtc-safetyanalysis-alloc.patch
> 
> This patch does seem to fix the issue.

I'd still wait for bhackett's input before blessing the fix as the proper one.

Comment 7

[Brian Hackett [Laid off!]]

Comment on attachment 787805 [details] [diff] [review]
bug903028-omtc-safetyanalysis-alloc.patch

Review of attachment 787805 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, we don't want to be triggering any read or write barriers while working off thread.

Comment 8

[Daniel Veditz [:dveditz]]

Is this really a "regression" if we don't know how far back it goes? Does ESR-17 or b2g18 support ParallelArrays?

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I think Shu-yu once mentioned that ParallelArrays are only enabled on Nightly for now, but I'd like his confirmation.

Comment 10

[Niko Matsakis [:nmatsakis]]

That is correct.

Comment 11

[Shu-yu Guo [:shu]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/d825964ccab6

Comment 12

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/d825964ccab6

Comment 13

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 787805 [details] [diff] [review]
bug903028-omtc-safetyanalysis-alloc.patch

I'd figure that bhackett's feedback+ really means a r+ in this instance.