978456 - Assertion failure: HasSSE2(), at jit/shared/Assembler-x86-shared.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for (var a = 0; a < 99; a++) {
    switch (7) {}
}

asserts 32-bit js debug shell on m-c changeset 8abc76dedec2 with --no-fpu --ion-parallel-compile=off at Assertion failure: HasSSE2(), at jit/shared/Assembler-x86-shared.h

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments" HOST_CXX="clang++ -Qunused-arguments" sh ./configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/508848ad378a
user:        Jan de Mooij
date:        Wed Feb 26 10:25:36 2014 +0100
summary:     Bug 939562 part 3 - Move JIT flags from ContextOptions to RuntimeOptions. r=bent,bholley,luke

Jan, is bug 939562 a likely regressor? Setting [fuzzblocker] as this is happening very often.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

Yes this is a (shell-only) regression from bug 939562. We have to call MacroAssembler::SetFloatingPointDisabled() before we create the JSRuntime.

The scary part is, I broke --tbpl and nobody noticed:

../jit-test/jit_test.py ./js/src/js --tbpl Table
[14| 0| 0| 0]  66% =================================>                 |   0.9s
FAIL - basic/testTableSwitch1.js
[18| 1| 0| 0]  90% =============================================>     |   1.0s
FAIL - basic/testTableSwitch2.js
[18| 2| 0| 0]  95% ===============================================>   |   1.1s
FAIL - jaeger/testTableSwitchX.js
[18| 3| 0| 0] 100% ==================================================>|   1.5s
FAILURES:
    --baseline-eager --no-ti --no-fpu jit-test/tests/basic/testTableSwitch1.js
    --baseline-eager --no-ti --no-fpu jit-test/tests/basic/testTableSwitch2.js
    --baseline-eager --no-ti --no-fpu jit-test/tests/jaeger/testTableSwitchX.js
TIMEOUTS:

I'll see if I can find out why, this is bad.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack with filenames

Comment 4

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #2)
> The scary part is, I broke --tbpl and nobody noticed:

> I'll see if I can find out why, this is bad.

I found out why: this failure is OS X only. It's subtle, but on other platforms, the JSC assembler's isSSE2Present() calls setSSECheckState() and this will set s_sseCheckState. On OS X, the assembler assumes SSE2 is always present and does not set s_sseCheckState.

On tbpl, we only test 64-bit OS X builds. If we had 32-bit builds, they would have failed.

Comment 5

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8ab0a696d2ec

Comment 6

[Ed Morley [:emorley]]

Backed out since bug 939562 has now been backed out:
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/572ba5387030

Comment 7

[Jan de Mooij [:jandem]]

I will fold this into the patch for bug 939562.