955822 - Crash [@ js::ThreadPoolWorker::getSlice] or Assertion failure: !used(), at jit/shared/Assembler-shared.h

Status: RESOLVED DUPLICATE of bug 1026919

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function h(g, x) {
    for (var j = 0; j < 99; ++j) {
        try {
            g(x[j], x[j]);
        } catch (e) {}
    }
}
f = (function(x, y) {
    ((-(Math.asinh(Math.fround(Math.fround(Math.round(x) < Math.fround(2))
        > Math.fround((-(~x)) >> 0)) !== eval("this")) >> 0)) | 0)
    (Math.n())
});
h(f, [-0])

asserts js debug shell on m-c changeset 4b242b19b006 with --ion-eager --ion-inlining=off --ion-check-range-analysis --ion-parallel-compile=off at Assertion failure: !used(), at jit/shared/Assembler-shared.h

My configure flags are:

CC="gcc -mfloat-abi=softfp -B/usr/lib/gcc/arm-linux-gnueabi/4.7" AR=ar CXX="g++ -mfloat-abi=softfp -B/usr/lib/gcc/arm-linux-gnueabi/4.7" sh ./configure --target=arm-linux-gnueabi --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

Setting needinfo from some folks who have fixed ARM / range analysis bugs recently.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> asserts js debug shell on m-c changeset 4b242b19b006 with

This was tested on the changeset rev with the patch in bug 952810 comment 2 applied.

Comment 2

[Douglas Crosher [:dougc]]

This appears to be related to issues with the buffer pools on the ARM backend.  The assertion failure occurs after an internal failure to pack the pools, which for now causes a compilation bailout that has any appearance of an OOM.

[Pools] [0] Finishing pool 1
[Pools] [0] Linking entry 2 in pool 1
[Pools] [0] Fixing offset to -1668
[Pools] [0] Linking entry 1 in pool 1
[Pools] [0] Fixing offset to -1508
[Pools] [0] Linking entry 6 in pool 0
[Pools] [0] Fixing offset to -1372
[Pools] [0]***Offset was still out of range!***
[Pools] [0] Too complicated; bailingp

The work in bug 760642 might address this.

However it might also indicate a failure in the OOM bailout paths.

Comment 3

[Dan Gohman [:sunfish]]

Clearing my needinfo, since comment 2 doesn't sound related to my changes.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Marty, any thoughts?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Variant testcases crash at js::ThreadPoolWorker::getSlice and assert similarly. (It is really difficult for me to get a reduced testcase that crashes but not asserts though)

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Doug, another one likely fixed by the recent assembler buffer changes?

Comment 8

[Douglas Crosher [:dougc]]

The pool allocation failure is resolved by bug 1026919, but it still bails out if the code goes over 32M or on OOM and these might still invoke the asserting failure. It should no longer fail on this test, so I am guessing this is reason enough to close this bug.