975335 - OdinMonkey: Assertion failure: pt && pt->associatedWith(rt), at vm/Runtime.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function(b, foreign, p) {
    "use asm";
    var ff = foreign.f
    function f(d1) {
        d1 = +d1
    }
})()

asserts js debug shell on m-c changeset b89a9d7b4ca0 with --fuzzing-safe --no-baseline --no-ion at Assertion failure: pt && pt->associatedWith(rt), at vm/Runtime.cpp

My configure flags are:

MAKE=mozmake AR=ar sh ./configure --host=x86_64-pc-mingw32 --target=x86_64-pc-mingw32 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-threadsafe <other NSPR options>

Due to broken builds, this issue may go as far back as mid-Jan 2014 (rev 17c463691232), but am unable to bisect further for now:

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b528de4b776f&tochange=d54433699f2e

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Can't reproduce locally. I've tried with the --fuzzing-safe --no-baseline --no-ion on a x64 Linux shell and a x86 Linux shell.
Is this platform and / or OS specific (Win7 x86)?

Comment 2

[Luke Wagner [:luke]]

The crash seems to be in Windows.  Looking at the crash stack, it seems like this is not so much related to Odin as it is to TlsPerThreadData on the js worker threads.  I'm suspecting that bug 941805 "broke" this by having WorkerThread.threadData's Runtime be nullptr, which is offending the assert.  But this whole assert doesn't seem necessary at all, we should be able to ask whether we are on a runtime's owner thread from any thread.  Can we just remove the assertion Brian?

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

Sure.  This also fixes CurrentThreadCanAccessZone which is similarly afflicted.

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 8379825 [details] [diff] [review]
patch

Nice

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6d1407d6ec52

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Benjamin Bouvier [:bbouvier] from comment #1)
> Can't reproduce locally. I've tried with the --fuzzing-safe --no-baseline
> --no-ion on a x64 Linux shell and a x86 Linux shell.
> Is this platform and / or OS specific (Win7 x86)?

Yes, this was Win64 debug shell-specific.

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6d1407d6ec52