Closed Bug 923614 Opened 11 years ago Closed 11 years ago

Intermittent conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending(), at ../../../js/src/jit/IonBuilder.cpp:3874

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla29
Tracking Flags:
Tracking Status
firefox27 --- fixed
firefox28 --- fixed
firefox29 --- fixed
firefox-esr24 --- unaffected
b2g-v1.2 --- unaffected

People

(Reporter: cbook, Assigned: bhackett1024)

References

(
URL
)

Details

(Keywords: assertion, intermittent-failure)

Attachments

(1 file)

remove assert, fix PropertyReadNeedsTypeBarrier
2.11 KB, patch
jandem
: review+
bkerensa
: approval-mozilla-aurora+
bkerensa
: approval-mozilla-beta+
Details | Diff | Splinter Review 
Rev5 MacOSX Mountain Lion 10.8 mozilla-inbound debug test mochitest-2 on 2013-10-03 21:26:02 PDT for push 48582b2df0af

slave: talos-mtnlion-r5-070

https://tbpl.mozilla.org/php/getParsedLog.php?id=28733554&tree=Mozilla-Inbound

Assertion failure: !cx->isExceptionPending(), at ../../../js/src/jit/IonBuilder.cpp:3766
PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)]
TEST-UNEXPECTED-FAIL | leakcheck | 2872 bytes leaked (CompositorChild, CondVar, Mutex, PCompositorChild, PLayerTransactionChild, ...)

Crash dump filename: /var/folders/sw/btl_pzz51db35_8cbx68yq8m00000w/T/tmplS8C5X/minidumps/ACEA1A14-6435-4A45-BDFE-D74161762611.dmp
21:36:29     INFO -  Operating system: Mac OS X
21:36:29     INFO -                    10.8.0 12A269
21:36:29     INFO -  CPU: amd64
21:36:29     INFO -       family 6 model 42 stepping 7
21:36:29     INFO -       8 CPUs
21:36:29     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
21:36:29     INFO -  Crash address: 0x0
21:36:29     INFO -  Thread 0 (crashed)
21:36:29     INFO -   0  XUL!js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*) [IonBuilder.cpp:48582b2df0af : 3704 + 0x0]
21:36:29     INFO -      rbx = 0x00007fff789fcc68   r12 = 0x00007fff5fbfac80
21:36:29     INFO -      r13 = 0x0000000164483c01   r14 = 0x00007fff5fbf9fb0
21:36:29     INFO -      r15 = 0x00007fff5fbfa480   rip = 0x0000000103a494c6
21:36:29     INFO -      rsp = 0x00007fff5fbf9700   rbp = 0x00007fff5fbf9f00
21:36:29     INFO -      Found by: given as instruction pointer in context
21:36:29     INFO -   1  XUL!js::jit::IonBuilder::inlineSingleCall(js::jit::CallInfo&, JSFunction*) [IonBuilder.cpp:48582b2df0af : 4069 + 0x4]
21:36:29     INFO -      rbx = 0x00007fff5fbfa070   r12 = 0x0000000122551800
21:36:29     INFO -      r13 = 0x0000000000000001   r14 = 0x00007fff5fbfa480
21:36:29     INFO -      r15 = 0x00007fff5fbf9fb0   rip = 0x0000000103a49f53
21:36:29     INFO -      rsp = 0x00007fff5fbf9f10   rbp = 0x00007fff5fbf9f10
21:36:29     INFO -      Found by: call frame info
21:36:29     INFO -   2  XUL!js::jit::IonBuilder::inlineCallsite(js::Vector<JSObject*, 4ul, js::jit::IonAllocPolicy>&, js::Vector<JSObject*, 4ul, js::jit::IonAllocPolicy>&, bool, js::jit::CallInfo&) [IonBuilder.cpp:48582b2df0af : 4111 + 0xd]
21:36:29     INFO -      rbx = 0x00007fff5fbfa070   r12 = 0x0000000122551800
21:36:29     INFO -      r13 = 0x0000000000000001   r14 = 0x00007fff5fbfa480
21:36:29     INFO -      r15 = 0x00007fff5fbf9fb0   rip = 0x0000000103a4a073
21:36:29     INFO -      rsp = 0x00007fff5fbf9f20   rbp = 0x00007fff5fbf9f90
21:36:29     INFO -      Found by: call frame info
21:36:29     INFO -   3  XUL!js::jit::IonBuilder::jsop_call(unsigned int, bool) [IonBuilder.cpp:48582b2df0af : 4944 + 0x1d]
21:36:29     INFO -      rbx = 0x00007fff5fbfa070   r12 = 0x0000000000000002
21:36:29     INFO -      r13 = 0x00007fff5fbfa050   r14 = 0x00007fff5fbfa480
21:36:29     INFO -      r15 = 0x0000000000000000   rip = 0x0000000103a417d3
21:36:29     INFO -      rsp = 0x00007fff5fbf9fa0   rbp = 0x00007fff5fbfa130
21:36:29     INFO -      Found by: call frame info
21:36:29     INFO -   4  XUL!js::jit::IonBuilder::inspectOpcode(JSOp) [IonBuilder.cpp:48582b2df0af : 1471 + 0x24]
21:36:29     INFO -      rbx = 0x00000000ffffff01   r12 = 0x0000000000000052
21:36:29     INFO -      r13 = 0x00007fff5fbfa480   r14 = 0x00007fff5fbfa480
21:36:29     INFO -      r15 = 0x0000000000000052   rip = 0x0000000103a3b5bc
21:36:29     INFO -      rsp = 0x00007fff5fbfa140   rbp = 0x00007fff5fbfa1f0
21:36:29     INFO -      Found by: call frame info
Summary: Intermittent PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !cx->isExceptionPending(), at ../../../js/sr → Intermittent PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending()
jandem, does this look like something that could happen in a low memory state?  It started happening a lot in the last two days when we starting hitting OOM conditions elsewhere.
Flags: needinfo?(jdemooij)
khuey thinks this may be related to OOMpocalypse 2
Blocks: 937997
No longer blocks: 937997
(In reply to Andrew McCreight [:mccr8] from comment #111)
> jandem, does this look like something that could happen in a low memory
> state?  It started happening a lot in the last two days when we starting
> hitting OOM conditions elsewhere.

Yes, we're likely hitting an OOM somewhere and calling js_ReportOutOfMemory, which will throw an exception...
Flags: needinfo?(jdemooij)
Depends on: 939369
We're still hitting this frequently. Can we please get someone to look into this further?
Flags: needinfo?(nihsanullah)
Were the underlying OOM situations dealt with and this still occurs? I gave it to jandem for now but if we are OOMing elsewhere this may not be a JIT bug.
Assignee: nobody → jdemooij
Flags: needinfo?(nihsanullah)
Well, it seems like the JIT should still catch this exception or whatever even if there are OOM problems.  The JIT seems more sensitive to these low VM situations than other things.
It looks like the ensureTrackedProperty callers are not propagating OOM properly. Brian, there's also some suspicious-looking code in jit::PropertyReadNeedsTypeBarrier:

    if (!property.maybeTypes()->enumerateTypes(&types))
        return false;

This looks like an OOM check, but returning false means we don't need a barrier...
Assignee: jdemooij → bhackett1024
Flags: needinfo?(bhackett1024)
Summary: Intermittent PROCESS-CRASH | /tests/dom/imptests/editing/conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending() → Intermittent conformancetest/test_runtest.html | application crashed [@ js::jit::IonBuilder::inlineScriptedCall(js::jit::CallInfo&, JSFunction*)] | Assertion failure: !analysisContext->isExceptionPending(), at ../../../js/src/jit/IonBuilder.cpp:3874
Bug 945754 fixed the ensureTrackPropertyTypes thing but this seems to have not gone away.

I don't think we check for a pending exception anywhere before Ion compilation or the definite properties analysis, so this pending exception could have come from anywhere in the VM.  Invariants surrounding is-there-an-exception-pending state in the VM are horribly underasserted so this could really be a bug anywhere in the VM.  We could add the above mentioned check and abort the definite properties analysis if there is a pending exception but that could lead to weird perf behavior.

So instead this patch just removes the assert, which is lame but seems the only recourse until the situation improves.  What this means is that if the inline builder fails but doesn't throw and there is an old exception around, that old exception will be thrown instead.  Whatever!

This also fixes the PropertyReadNeedsTypeBarrier weirdness.
Attachment #8342782 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Comment on attachment 8342782 [details] [diff] [review]
remove assert, fix PropertyReadNeedsTypeBarrier

Review of attachment 8342782 [details] [diff] [review]:
-----------------------------------------------------------------

Last week I fixed the error propagation from the script->getOrCreateScript(analysisContext) call, but looks like that didn't help here. So comment 178 is probably correct and this is an older exception.
Attachment #8342782 - Flags: review?(jdemooij) → review+
Other oranges this will probably fix \m/ :
Bug 918014, bug 923953, bug 924324, bug 926420, bug 939714.

I'll resolve them in a couple days once we're sure the failure hasn't morphed.
Flags: needinfo?(ryanvm)
https://hg.mozilla.org/mozilla-central/rev/673f57bf0ff7
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
Looking good! Brian, can you please nominate this for uplift to Aurora & Beta? Thanks!
Flags: needinfo?(ryanvm) → needinfo?(bhackett1024)
Comment on attachment 8342782 [details] [diff] [review]
remove assert, fix PropertyReadNeedsTypeBarrier

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Unknown
User impact if declined: Intermittent assertion failure on TBPL
Testing completed (on m-c, etc.): on m-c
Risk to taking this patch (and alternatives if risky): None
Attachment #8342782 - Flags: approval-mozilla-beta?
Attachment #8342782 - Flags: approval-mozilla-aurora?
Flags: needinfo?(bhackett1024)
Comment on attachment 8342782 [details] [diff] [review]
remove assert, fix PropertyReadNeedsTypeBarrier

Review of attachment 8342782 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good we will go ahead and approve this for uplift!
Attachment #8342782 - Flags: approval-mozilla-beta?
Attachment #8342782 - Flags: approval-mozilla-beta+
Attachment #8342782 - Flags: approval-mozilla-aurora?
Attachment #8342782 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: