936891 - Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Modified registers between VM call and OsiPoint)), at jit/shared/CodeGenerator-shared.cpp:532

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 16949049f03d (threadsafe build, run with --fuzzing-safe --ion-eager --ion-regalloc=backtracking):


enableOsiPointRegisterChecks();
function rec(x, self) {
    if (1 && this) {}
}
for (var i = 0; i < 20; ++i)
    rec(1, rec);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Dan Gohman [:sunfish]]

The immediate difference between LinearScan and Backtracking here is the odd way that LinearScan does liveness. The allocators register allocate the same way:

 [16,17 Value] [def v4 =rcx]
 [18,19 ComputeThis] [def v5 =rcx] [use v4:r =rcx]

LinearScan calls this LiveInterval of rcx [16,18>, while Backtracking calls it [17,19>.

addLiveRegistersForInterval is doing a lookup to determine which interval contains the use at position 18. For LinearScan, [16,18> doesn't contain 18. For Backtracking, [17,19> does.

Comment 3

[Dan Gohman [:sunfish]]

Attachment: regalloc-safepoint-positions.patch

This patch fixes the given testcase by fixing a few places in safepoint handling to account for the different ways that LinearScan and Backtracking use liveness.

Comment 4

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0aeda4bd3113

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0aeda4bd3113

Comment 6

[Ada [:adalucinet]]

With Nightly js shell builds from 2013-11-10 and 2013-11-11 I get nothing on Ubuntu 13.10 x64.
The same with FF 28 beta 2 shell.
Is there any other way to reproduce this assertion and verify the fix?

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've verified this.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0aeda4bd3113
user:        Dan Gohman
date:        Tue Nov 12 05:46:43 2013 -0800
summary:     Bug 936891 - IonMonkey: Fix safepoint handling to mind the differences between LSRA and Backtracking. r=bhackett