925309 - Assertion failure: enable == !(bool)spsOn_, at jit/BaselineJIT.cpp:777

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision aa986b6ce882 (run with --fuzzing-safe --ion-eager):


for(;; enableSPSProfilingAssertions(false)) {}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0eaefffce290
user:        Kannan Vijayan
date:        Fri Mar 22 13:42:52 2013 -0400
summary:     Bug 846363 - Integrate SPS Profiler with Baseline. r=jandem

This iteration took 1.279 seconds to run.

Comment 3

[Kannan Vijayan [:djvj]]

Attachment: sps-bug-925309.patch

Problem: if SPS profiler is turned on multiple times, tries to toggle SPS flags on baseline script multiple times, but baseline script asserts because SPS flags have already been toggled on.

Solution: if profiler is already enabled, then enabling profiler should be a no-op.

Added a modified test case for this because the original test case will loop forever when it works successfully.

Comment 4

[Kannan Vijayan [:djvj]]

Comment on attachment 828905 [details] [diff] [review]
sps-bug-925309.patch

Review of attachment 828905 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/SPSProfiler.cpp
@@ +52,5 @@
>  SPSProfiler::enable(bool enabled)
>  {
>      JS_ASSERT(installed());
> +
> +    // Don't enable when already enabled.

NOTE: I'm removing this comment as it's useless.

Comment 5

[Kannan Vijayan [:djvj]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7e1276c372c2

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7e1276c372c2

Comment 7

[Ioana (away)]

Reproduced with the 11/01 Fx28 JS shell, verified as fixed with the 02/04 Fx28 shell.