920114 - BananaBread/Boon Inception Demo (FPS in FPS) aborts debug build with "Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Float32 flowing into a non float specialized operation)), at js/src/jit/IonAnalysis.cpp:932"

Status: RESOLVED DUPLICATE of bug 919118

(Core :: JavaScript Engine, defect)

Description

[Daniel Holbert [:dholbert]]

STR:
 1. Visit http://kripken.github.io/boon/inception/game.html?low,low in a debug build. 

(I'm using a --disable-optimize --enable-debug; not sure if the --disable-optimize part is important for triggering this or not)

 2. Wait a while for the site to load. (It takes on the order of 5 minutes on my machine, with this debug build.

 3. Try to play the FPS within a FPS.

ACTUAL RESULTS: Very soon (within a minute), I abort with this meesage:
Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Float32 flowing into a non float specialized operation)), at js/src/jit/IonAnalysis.cpp:932

...followed by zillions of lines of this message:
Assertion failure: js::CurrentThreadCanAccessRuntime(runtime_), at js/src/vm/Runtime.h:1784

I reproduced this twice in the same debug build. The build is a few days old -- from http://hg.mozilla.org/mozilla-central/rev/59beb1868522 -- but I imagine it still reproduces in up-to-date builds. (I'll double-check)

Comment 1

[Alon Zakai (:azakai)]

I think this is a dupe of bug 919118.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

(In reply to Alon Zakai (:azakai) from comment #1)
> I think this is a dupe of bug 919118.

Indeed. I tried with the patch in bug 919118 and could play for 5 minutes.

Comment 3

[Daniel Holbert [:dholbert]]

I applied the patch from bug 919118, and now it aborts with:

Assertion failure: consumer->isConsistentFloat32Use(), at js/src/jit/IonAnalysis.cpp:922
...followed by a zillion instances of:
Assertion failure: js::CurrentThreadCanAccessRuntime(runtime_), at js/src/vm/Runtime.h:1785

Comment 4

[Daniel Holbert [:dholbert]]

Should I reopen this bug for comment 3?  Or should we reopen bug 919118?

(I'm still getting a "zillion CurrentThreadCanAccessRuntime assertion-failures after one other assertion-failure" issue; it's just a slightly different first assertion now. Still aborting.)

Comment 5

[Benjamin Bouvier [:bbouvier] (inactive)]

(In reply to Daniel Holbert [:dholbert] from comment #4)
> Should I reopen this bug for comment 3?  Or should we reopen bug 919118?
> 
> (I'm still getting a "zillion CurrentThreadCanAccessRuntime
> assertion-failures after one other assertion-failure" issue; it's just a
> slightly different first assertion now. Still aborting.)

I tried it yesterday in debug mode with also the patch in bug 915903 (which is a similar bug), as the same thing can occur with TruncateToInt32. After 5 minutes of playing, didn't have any issue. We should reopen it if it fails with these applied.

If you can put a breakpoint on the assertion, can you check that |call consumer->op()| (on the frame that asserts, which should be a function of IonAnalysis.cpp) returns MTruncateToInt32? Otherwise, that's a different bug.

Comment 6

[Daniel Holbert [:dholbert]]

(In reply to Benjamin Bouvier [:bbouvier] from comment #5)
> I tried it yesterday in debug mode with also the patch in bug 915903 (which
> is a similar bug), as the same thing can occur with TruncateToInt32. After 5
> minutes of playing, didn't have any issue. We should reopen it if it fails
> with these applied.

Cool -- with that bug's patch applied as well, I can't reproduce anymore. (I was able to play for a few minutes, in a debug build, whereas previously it'd abort within the first minute of playing.)

Thanks!