New issue
Advanced search Search tips

Issue 672367 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Regression

Blocking:
issue 619264
issue 673531



Sign in to add a comment

V8 regression: Check failed: !cached.code->marked_for_deoptimization().

Project Member Reported by kbr@chromium.org, Dec 8 2016

Issue description

This assertion failure started getting hit during nearly every run of the webgl2_conformance_tests after this V8 roll:

https://chromium.googlesource.com/chromium/src/+/5e860022a92049a25394d2a4ee9d1362377b444b

A few example failures:

https://build.chromium.org/p/chromium.gpu.fyi/builders/Mac%20Retina%20Release/builds/9416
https://build.chromium.org/p/chromium.gpu.fyi/builders/Mac%20Retina%20Release/builds/9415
https://build.chromium.org/p/chromium.gpu.fyi/builders/Mac%20Retina%20Release/builds/9414

Example stack trace:

WebglConformance_deqp_functional_gles3_shadertexturefunction_textureprojgradoffset (gpu_tests.webgl_conformance_integration_test.WebGLConformanceIntegrationTest) ... 

#
# Fatal error in ../../v8/src/compiler.cc, line 490
# Check failed: !cached.code->marked_for_deoptimization().
#

==== C stack trace ===============================

0 Chromium Framework 0x00000001137e63a3 v8::base::debug::StackTrace::StackTrace() + 19
1 Chromium Framework 0x00000001137e27fd V8_Fatal + 221
2 Chromium Framework 0x000000010ff8668d v8::internal::(anonymous namespace)::GetCodeFromOptimizedCodeMap(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::BailoutId) + 541
3 Chromium Framework 0x000000010ff7f372 v8::internal::(anonymous namespace)::GetOptimizedCode(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Compiler::ConcurrencyMode, v8::internal::BailoutId, v8::internal::JavaScriptFrame*) + 274
4 Chromium Framework 0x000000010ff85745 v8::internal::Compiler::GetOptimizedCodeForOSR(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::BailoutId, v8::internal::JavaScriptFrame*) + 37
5 Chromium Framework 0x00000001105678cb v8::internal::__RT_impl_Runtime_CompileForOnStackReplacement(v8::internal::Arguments, v8::internal::Isolate*) + 1643
6 ??? 0x000023ac1140426e 0x0 + 39221930771054
7 ??? 0x000023ac114cf0f5 0x0 + 39221931602165
Received signal 4 <unknown> 0001137e4ca2


This is blocking graphics changes from landing via the CQ. https://build.chromium.org/p/tryserver.chromium.mac/builders/mac_optional_gpu_tests_rel/builds/5575 got hit by this bogus assert.

I'm stopping V8 rolls and reverting to the roll before this one.

 

Comment 1 by kbr@chromium.org, Dec 8 2016

Labels: OS-All

Comment 2 by kbr@chromium.org, Dec 8 2016

Reverting the last V8 roll in https://codereview.chromium.org/2564483002/ .

Comment 3 by kbr@chromium.org, Dec 8 2016

Revert landed in c11540b2cefdf3a5207838fc16500dce433cada6 .

Cc: -mvstan...@chromium.org jarin@chromium.org mstarzinger@chromium.org
Labels: Arch-All
Owner: mvstan...@chromium.org
Status: Assigned (was: Untriaged)
Very likely https://codereview.chromium.org/2549753002, I'm going to revert that one.

Comment 5 by kbr@chromium.org, Dec 8 2016

Blocking: 619264
New roll attempt with the revert in:
https://codereview.chromium.org/2556023004/
Status: Fixed (was: Assigned)
I've identified the bug, this CL isolates it: https://codereview.chromium.org/2554353003/

Will reland later with fix in place, sorry about that!

Comment 8 by kbr@chromium.org, Dec 12 2016

Blocking: 673531

Sign in to add a comment