947671 - Valgrind-on-TBPL: Valgrind sometimes crashes in JIT code

Status: RESOLVED FIXED

(Testing :: General, defect)

Description

[Nicholas Nethercote [inactive]]

Attachment: Valgrind output

Valgrind crashed during this TBPL run:  https://tbpl.mozilla.org/php/getParsedLog.php?id=31614621&tree=Mozilla-Central&full=1

The relevant part of the log is attached.  There is an invalid read of size 4 in js::jit::Assembler::CodeFromJump, and then immediately afterwards Valgrind fails with "Unsupported clone() flags: 0x800600".  This is because a crash occurs and breakpad is entered, and breakpad does a clone that Valgrind can't handle.

I've seen crashes like this locally.  I suspect that nothing notable changed in the past 24 hours, but that it occurs non-deterministically.

It smells a lot like imprecise exceptions are the cause, as we've seen in some other bugs recently.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> The relevant part of the log is attached.  There is an invalid read of size
> 4 in js::jit::Assembler::CodeFromJump

There was bug 914511, which also had js::jit::Assembler::TraceJumpRelocations on that stack, but that bug seemed fixed.

Comment 2

[Nicholas Nethercote [inactive]]

Happened again:
https://tbpl.mozilla.org/php/getParsedLog.php?id=31693450&tree=Mozilla-Central

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan might be the JIT go-to person here.

Comment 4

[Nicholas Nethercote [inactive]]

I tried turning on --vex-iropt-register-updates=allregs-at-each-insn to see if it helps:
https://hg.mozilla.org/build/tools/rev/c46f324a8b46

Comment 5

[Nicholas Nethercote [inactive]]

> I tried turning on --vex-iropt-register-updates=allregs-at-each-insn

And it does seem to be working.  I don't think I've seen a crash since I pushed that change...

Comment 6

[Jan de Mooij [:jandem]]

(In reply to Nicholas Nethercote [:njn] from comment #5)
> And it does seem to be working.  I don't think I've seen a crash since I
> pushed that change...

Great, clearing needinfo then.

Comment 7

[Nicholas Nethercote [inactive]]

I'm going to declare victory here.