Closed Bug 923614 Opened 12 years ago Closed 12 years ago

Intermittent conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending(), at ../../../js/src/jit/IonBuilder.cpp:3874

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla29
Tracking Flags:
Tracking Status
firefox27 --- fixed
firefox28 --- fixed
firefox29 --- fixed
firefox-esr24 --- unaffected
b2g-v1.2 --- unaffected

People

(Reporter: cbook, Assigned: bhackett1024)

References

(
URL
)

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

remove assert, fix PropertyReadNeedsTypeBarrier
2.11 KB, patch
jandem
: review+
bkerensa
: approval-mozilla-aurora+
bkerensa
: approval-mozilla-beta+
Details | Diff | Splinter Review
Rev5 MacOSX Mountain Lion 10.8 mozilla-inbound debug test mochitest-2 on 2013-10-03 21:26:02 PDT for push 48582b2df0af slave: talos-mtnlion-r5-070 https://tbpl.mozilla.org/php/getParsedLog.php?id=28733554&tree=Mozilla-Inbound Assertion failure: !cx->isExceptionPending(), at ../../../js/src/jit/IonBuilder.cpp:3766 PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] TEST-UNEXPECTED-FAIL | leakcheck | 2872 bytes leaked (CompositorChild, CondVar, Mutex, PCompositorChild, PLayerTransactionChild, ...) Crash dump filename: /var/folders/sw/btl_pzz51db35_8cbx68yq8m00000w/T/tmplS8C5X/minidumps/ACEA1A14-6435-4A45-BDFE-D74161762611.dmp 21:36:29 INFO - Operating system: Mac OS X 21:36:29 INFO - 10.8.0 12A269 21:36:29 INFO - CPU: amd64 21:36:29 INFO - family 6 model 42 stepping 7 21:36:29 INFO - 8 CPUs 21:36:29 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS 21:36:29 INFO - Crash address: 0x0 21:36:29 INFO - Thread 0 (crashed) 21:36:29 INFO - 0 XUL!js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*) [IonBuilder.cpp:48582b2df0af : 3704 + 0x0] 21:36:29 INFO - rbx = 0x00007fff789fcc68 r12 = 0x00007fff5fbfac80 21:36:29 INFO - r13 = 0x0000000164483c01 r14 = 0x00007fff5fbf9fb0 21:36:29 INFO - r15 = 0x00007fff5fbfa480 rip = 0x0000000103a494c6 21:36:29 INFO - rsp = 0x00007fff5fbf9700 rbp = 0x00007fff5fbf9f00 21:36:29 INFO - Found by: given as instruction pointer in context 21:36:29 INFO - 1 XUL!js::jit::IonBuilder::inlineSingleCall(js::jit::CallInfo&, JSFunction*) [IonBuilder.cpp:48582b2df0af : 4069 + 0x4] 21:36:29 INFO - rbx = 0x00007fff5fbfa070 r12 = 0x0000000122551800 21:36:29 INFO - r13 = 0x0000000000000001 r14 = 0x00007fff5fbfa480 21:36:29 INFO - r15 = 0x00007fff5fbf9fb0 rip = 0x0000000103a49f53 21:36:29 INFO - rsp = 0x00007fff5fbf9f10 rbp = 0x00007fff5fbf9f10 21:36:29 INFO - Found by: call frame info 21:36:29 INFO - 2 XUL!js::jit::IonBuilder::inlineCallsite(js::Vector<JSObject*, 4ul, js::jit::IonAllocPolicy>&, js::Vector<JSObject*, 4ul, js::jit::IonAllocPolicy>&, bool, js::jit::CallInfo&) [IonBuilder.cpp:48582b2df0af : 4111 + 0xd] 21:36:29 INFO - rbx = 0x00007fff5fbfa070 r12 = 0x0000000122551800 21:36:29 INFO - r13 = 0x0000000000000001 r14 = 0x00007fff5fbfa480 21:36:29 INFO - r15 = 0x00007fff5fbf9fb0 rip = 0x0000000103a4a073 21:36:29 INFO - rsp = 0x00007fff5fbf9f20 rbp = 0x00007fff5fbf9f90 21:36:29 INFO - Found by: call frame info 21:36:29 INFO - 3 XUL!js::jit::IonBuilder::jsop_call(unsigned int, bool) [IonBuilder.cpp:48582b2df0af : 4944 + 0x1d] 21:36:29 INFO - rbx = 0x00007fff5fbfa070 r12 = 0x0000000000000002 21:36:29 INFO - r13 = 0x00007fff5fbfa050 r14 = 0x00007fff5fbfa480 21:36:29 INFO - r15 = 0x0000000000000000 rip = 0x0000000103a417d3 21:36:29 INFO - rsp = 0x00007fff5fbf9fa0 rbp = 0x00007fff5fbfa130 21:36:29 INFO - Found by: call frame info 21:36:29 INFO - 4 XUL!js::jit::IonBuilder::inspectOpcode(JSOp) [IonBuilder.cpp:48582b2df0af : 1471 + 0x24] 21:36:29 INFO - rbx = 0x00000000ffffff01 r12 = 0x0000000000000052 21:36:29 INFO - r13 = 0x00007fff5fbfa480 r14 = 0x00007fff5fbfa480 21:36:29 INFO - r15 = 0x0000000000000052 rip = 0x0000000103a3b5bc 21:36:29 INFO - rsp = 0x00007fff5fbfa140 rbp = 0x00007fff5fbfa1f0 21:36:29 INFO - Found by: call frame info
Summary: Intermittent PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !cx->isExceptionPending(), at ../../../js/sr → Intermittent PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending()
jandem, does this look like something that could happen in a low memory state? It started happening a lot in the last two days when we starting hitting OOM conditions elsewhere.
Flags: needinfo?(jdemooij)
khuey thinks this may be related to OOMpocalypse 2
Blocks: 937997
No longer blocks: 937997
(In reply to Andrew McCreight [:mccr8] from comment #111) > jandem, does this look like something that could happen in a low memory > state? It started happening a lot in the last two days when we starting > hitting OOM conditions elsewhere. Yes, we're likely hitting an OOM somewhere and calling js_ReportOutOfMemory, which will throw an exception...
Flags: needinfo?(jdemooij)
Depends on: 939369
We're still hitting this frequently. Can we please get someone to look into this further?
Flags: needinfo?(nihsanullah)
Were the underlying OOM situations dealt with and this still occurs? I gave it to jandem for now but if we are OOMing elsewhere this may not be a JIT bug.
Assignee: nobody → jdemooij
Flags: needinfo?(nihsanullah)
Well, it seems like the JIT should still catch this exception or whatever even if there are OOM problems. The JIT seems more sensitive to these low VM situations than other things.
It looks like the ensureTrackedProperty callers are not propagating OOM properly. Brian, there's also some suspicious-looking code in jit::PropertyReadNeedsTypeBarrier: if (!property.maybeTypes()->enumerateTypes(&types)) return false; This looks like an OOM check, but returning false means we don't need a barrier...
Assignee: jdemooij → bhackett1024
Flags: needinfo?(bhackett1024)
Summary: Intermittent PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending() → Intermittent conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending(), at ../../../js/src/jit/IonBuilder.cpp:3874
Bug 945754 fixed the ensureTrackPropertyTypes thing but this seems to have not gone away. I don't think we check for a pending exception anywhere before Ion compilation or the definite properties analysis, so this pending exception could have come from anywhere in the VM. Invariants surrounding is-there-an-exception-pending state in the VM are horribly underasserted so this could really be a bug anywhere in the VM. We could add the above mentioned check and abort the definite properties analysis if there is a pending exception but that could lead to weird perf behavior. So instead this patch just removes the assert, which is lame but seems the only recourse until the situation improves. What this means is that if the inline builder fails but doesn't throw and there is an old exception around, that old exception will be thrown instead. Whatever! This also fixes the PropertyReadNeedsTypeBarrier weirdness.
Attachment #8342782 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Comment on attachment 8342782 [details] [diff] [review] remove assert, fix PropertyReadNeedsTypeBarrier Review of attachment 8342782 [details] [diff] [review]: ----------------------------------------------------------------- Last week I fixed the error propagation from the script->getOrCreateScript(analysisContext) call, but looks like that didn't help here. So comment 178 is probably correct and this is an older exception.
Attachment #8342782 - Flags: review?(jdemooij) → review+
Other oranges this will probably fix \m/ : Bug 918014, bug 923953, bug 924324, bug 926420, bug 939714. I'll resolve them in a couple days once we're sure the failure hasn't morphed.
Flags: needinfo?(ryanvm)
https://hg.mozilla.org/mozilla-central/rev/673f57bf0ff7
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
Looking good! Brian, can you please nominate this for uplift to Aurora & Beta? Thanks!
Flags: needinfo?(ryanvm) → needinfo?(bhackett1024)
Comment on attachment 8342782 [details] [diff] [review] remove assert, fix PropertyReadNeedsTypeBarrier [Approval Request Comment] Bug caused by (feature/regressing bug #): Unknown User impact if declined: Intermittent assertion failure on TBPL Testing completed (on m-c, etc.): on m-c Risk to taking this patch (and alternatives if risky): None
Attachment #8342782 - Flags: approval-mozilla-beta?
Attachment #8342782 - Flags: approval-mozilla-aurora?
Flags: needinfo?(bhackett1024)
Comment on attachment 8342782 [details] [diff] [review] remove assert, fix PropertyReadNeedsTypeBarrier Review of attachment 8342782 [details] [diff] [review]: ----------------------------------------------------------------- Looks good we will go ahead and approve this for uplift!
Attachment #8342782 - Flags: approval-mozilla-beta?
Attachment #8342782 - Flags: approval-mozilla-beta+
Attachment #8342782 - Flags: approval-mozilla-aurora?
Attachment #8342782 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: