987442 - Assertion failure: frame->left == 0, at vm/SPSProfiler.h:402

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision fa098f9fe89c (run with --fuzzing-safe --ion-eager --ion-compile-try-catch):


loadFile("for(var i = (0); i < 100; enableSPSProfilingAssertions(false), f0++) {}");
loadFile("");
function loadFile(lfVarx) {
    try {
        function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); 
    } catch (lfVare) {}
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140318150004" and the hash "c0e333b0f7dc".
The "bad" changeset has the timestamp "20140318151801" and the hash "023f5ed842c8".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c0e333b0f7dc&tochange=023f5ed842c8

Kannan, bug 948229 might be the culprit, is it a likely regressor?

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/c8275c5686d5
user:        Kannan Vijayan
date:        Tue Mar 18 18:07:17 2014 -0400
summary:     Bug 948229 - Stop ion from pushing pseudostack entries by default for inline frames. r=h4writer

This iteration took 424.545 seconds to run.

Comment 4

[Kannan Vijayan [:djvj]]

I can't reproduce this locally on the given revision (building for x86-32 debug on linux), but I suspect there's a simple fix.  Can you test the patch I'm about to attach?

Comment 5

[Kannan Vijayan [:djvj]]

Attachment: test-fix-bug-987442.patch

Attempted fix.  Decoder can you try this?

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 8396532 [details] [diff] [review]
test-fix-bug-987442.patch

enableSPSProfilingAssertions(false)
function f() {
    g()
}
function g() {
    return (function(x) {
        if (x) {
            return
        }
        throw []
    })()
}
try {
    f()
} catch (e) {}
f()

Assertion failure: frame->left == 0, at vm/SPSProfiler.h

Kannan, here's a testcase (causing the same assert) that I'm fairly sure you can use to reproduce on Mac 64-bit with --ion-eager --ion-parallel-compile=off, and thus can perhaps land as a testcase.

And I've tested that this patch does fix the issue.

Comment 7

[Kannan Vijayan [:djvj]]

Comment on attachment 8396532 [details] [diff] [review]
test-fix-bug-987442.patch

We "reset" the compile-time frame tracking when generating OOL code.  When doing this, I was forgetting to make sure that the "next" empty entry that would be used when the OOL code was left (to enter a call for example), was not properly cleared.

Comment 8

[Kannan Vijayan [:djvj]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e2e511a35e67

Comment 9

[Christian Holler (:decoder)]

Comment on attachment 8396532 [details] [diff] [review]
test-fix-bug-987442.patch

Canceling feedback since gkw already tested this. Thanks!

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e2e511a35e67