943723 - Nightly hangs with this test case (typed objects)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jaswanth Sreeram]

Attachment: testcase.html

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36

Steps to reproduce:

Open attached file in Nightly (Windows 7, 64-bit)


Actual results:

Nightly hangs.


Expected results:

Should display "Hello World" on the page and "Finish" in the console.

Comment 1

[Jaswanth Sreeram]

User agent is incorrect above. Should be:

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0

Comment 2

[Niko Matsakis [:nmatsakis]]

The program contained within the attachment is:


        // Type: 3D array of size 100 x 100 x 4, each element is uint8Clamped
        var ElementTypeClamped = new TypedObject.ArrayType(TypedObject.uint8Clamped, 4);
        var RowTypeClamped = new TypedObject.ArrayType(ElementTypeClamped, 100);
        var MatrixTypeClamped = new TypedObject.ArrayType(RowTypeClamped, 100);

        // Type: 3D array of size 100 x 100 x 4, each element is uint8
        var ElementType = new TypedObject.ArrayType(TypedObject.uint8, 4);
        var RowType = new TypedObject.ArrayType(ElementType, 100);
        var MatrixType = new TypedObject.ArrayType(RowType, 100);

        // Create and initialize a matrix. Each element will be set equal to the vector v of size 1 x 4
        // VarType is either MatrixType or MatrixTypeClamped
        var createMat = function(VarType, v) {
            var newMat = new VarType();
            for (var r = 0; r < 100; r++)
                for (var c = 0; c < 100; c++)
                    for (var d = 0; d < 4; d++)
                        newMat[r][c][d] = v[d];
            return newMat;
        };

        var matA, matB, matC, matD, matE, matF, matG, matH, matI, matX, matY, matZ;

        matA = createMat(MatrixTypeClamped, [1, 2, 3, 4]);
        matB = createMat(MatrixTypeClamped, [0, 0, 0, 1]);
        matC = createMat(MatrixTypeClamped, [5, 2, 3, 2]);
        matD = createMat(MatrixTypeClamped, [5, 3, 6, 1]);
        matE = createMat(MatrixTypeClamped, [2, 2, 2, 2]);

        /* // Uncomment this if you have not encounter hang-up problem */
        matF = createMat(MatrixTypeClamped, [2, 2, 3, 2]);
        matG = createMat(MatrixTypeClamped, [2, 2, 3, 2]);
        matH = createMat(MatrixTypeClamped, [2, 2, 3, 2]);
        matX = createMat(MatrixTypeClamped, [1, 0, 1, 0]);
        matY = createMat(MatrixTypeClamped, [0, 0, 2, 0]);
        matZ = createMat(MatrixTypeClamped, [1, 2, 5, 10]);
        

        // This causes the hang-up problem.
        // Note: matI is of different type as all the above variables
        matI = createMat(MatrixType, [1, 2, 3, 5]);

        /* // If replacing the above matI instruction by the following line, no hang-up problem. Why?
        matI = createMat(MatrixTypeClamped, [1, 2, 3, 4])
        */

        console.log('Finish');

Comment 3

[Paul Silaghi, QA [:pauly]]

Confirmed.

Last good nightly: 2013-11-08
First bad nightly: 2013-11-09

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f003c386c77a&tochange=9e571ad29946

Comment 4

[Boris Zbarsky [:bzbarsky]]

Given the pushlog, presumably a regression from bug 933269?

Comment 5

[Felix S. Klock II [:pnkfelix, :fklock]]

i'll try to look soon, hopefully today.

Comment 6

[Niko Matsakis [:nmatsakis]]

This is likely caused by the incorrect binary search in TypeRepresentationSet.cpp. If so, the fix is a one-line change: 

diff --git a/js/src/jit/TypeRepresentationSet.cpp b/js/src/jit/TypeRepresentationSet.cpp
index 91d251e..5f6207a 100644
--- a/js/src/jit/TypeRepresentationSet.cpp
+++ b/js/src/jit/TypeRepresentationSet.cpp
@@ -82,7 +82,7 @@ TypeRepresentationSetBuilder::insert(TypeRepresentation *typeRepr)
 
         if (entryiaddr < typeReprAddr) {
             // typeRepr lies to the right of entry i
-            min = i + 1;
+            min = i;
         } else {
             // typeRepr lies to the left of entry i
             max = i;


this fix is included in the patch for bug 922115 but is really independent of that bug.

Comment 7

[Niko Matsakis [:nmatsakis]]

Actually, that patch is reversed, sorry. You get the idea, anyway :)

Comment 8

[Felix S. Klock II [:pnkfelix, :fklock]]

I was briefly worried that the while test needed to be changed from `while (min != max)` to `while (min < max)`, ...

... but since we have the invariant `i < max`, the loop invariant `min <= max` should still hold even with this change, and thus `while (min != max)` should still suffice.

Comment 9

[Felix S. Klock II [:pnkfelix, :fklock]]

Pushed the one-line fix to inbound (using Niko as author and me as reviewer):

  https://hg.mozilla.org/integration/mozilla-inbound/rev/94759f93f65e

Comment 10

[Felix S. Klock II [:pnkfelix, :fklock]]

We should make better tests for this part of the code.  Filed Bug 946187 for that.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/94759f93f65e

Comment 12

[Ada [:adalucinet]]

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0

Reproduced with Nightly from 2013-11-28.
With the attached testcase, the latest Aurora (Build ID: 20140121004017) doesn't hang, but I didn't get the same expected results as in comment 0: "ReferenceError: TypedObject is not defined" is displayed in the console, not "Finish".  
Any thoughts?

Comment 13

[Till Schneidereit [:till]]

This can't be tested on Aurora, because TypedObject is currently Nightly-only. It will be enabled on Aurora and beyond once the spec and our implementation have stabilized enough.

Comment 14

[u279076]

(In reply to Till Schneidereit [:till] from comment #13)
> This can't be tested on Aurora, because TypedObject is currently
> Nightly-only. It will be enabled on Aurora and beyond once the spec and our
> implementation have stabilized enough.

In that case setting this as [qa-]. Please renominate for testing once TypeObject is on Aurora.