<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 22, 2017, at 12:23 PM, Saam barati <<a href="mailto:sbarati@apple.com" class="">sbarati@apple.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" class=""><div class=""><br class="Apple-interchange-newline">On Feb 22, 2017, at 12:16 PM, Filip Pizlo <<a href="mailto:fpizlo@apple.com" class="">fpizlo@apple.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class=""><blockquote type="cite" class="">On Feb 22, 2017, at 11:58 AM, Geoffrey Garen <<a href="mailto:ggaren@apple.com" class="">ggaren@apple.com</a>> wrote:<br class=""><br class="">I’ve lost countless hours to investigating CrashTracers that would have been easy to solve if I had access to register state.<br class=""></blockquote><br class="">The current RELEASE_ASSERT means that every assertion in what the compiler thinks is a function (i.e. some function and everything inlined into it) is coalesced into a single trap site. I’d like to understand how you use the register state if you don’t even know which assertion you are at.<br class=""></div></div></blockquote>When I disassemble JavaScriptCore, I often find a succession of int3s at the bottom of a function. Does LLVM sometimes combine them and sometimes not?</div></div></blockquote><div><br class=""></div><div>Yeah.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">For example, this is what the bottom of the<span class="Apple-converted-space"> </span><font face="Menlo" class="">__ZN3JSC20AbstractModuleRecord18getModuleNamespaceEPNS_9ExecStateE</font><span class="Apple-converted-space"> </span>looks like:</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><font face="Menlo" class="">0000000000005c25<span class="Apple-tab-span" style="white-space: pre;"> </span>popq<span class="Apple-tab-span" style="white-space: pre;"> </span>%r14</font></div><div class=""><font face="Menlo" class="">0000000000005c27<span class="Apple-tab-span" style="white-space: pre;"> </span>popq<span class="Apple-tab-span" style="white-space: pre;"> </span>%r15</font></div><div class=""><font face="Menlo" class="">0000000000005c29<span class="Apple-tab-span" style="white-space: pre;"> </span>popq<span class="Apple-tab-span" style="white-space: pre;"> </span>%rbp</font></div><div class=""><font face="Menlo" class="">0000000000005c2a<span class="Apple-tab-span" style="white-space: pre;"> </span>retq</font></div><div class=""><font face="Menlo" class="">0000000000005c2b<span class="Apple-tab-span" style="white-space: pre;"> </span>int3</font></div><div class=""><font face="Menlo" class="">0000000000005c2c<span class="Apple-tab-span" style="white-space: pre;"> </span>int3</font></div><div class=""><font face="Menlo" class="">0000000000005c2d<span class="Apple-tab-span" style="white-space: pre;"> </span>int3</font></div><div class=""><font face="Menlo" class="">0000000000005c2e<span class="Apple-tab-span" style="white-space: pre;"> </span>int3</font></div><div class=""><font face="Menlo" class="">0000000000005c2f<span class="Apple-tab-span" style="white-space: pre;"> </span>nop</font></div></div></div></blockquote><div><br class=""></div><div>I’m curious how many branches target those traps.</div><div><br class=""></div><div>For example in the GC, I was often getting crashes that LLVM was convinced were vector overflow. Turns out that the compiler loves to coalesce other traps with the one from the vector overflow assert, so if you assert for some random reason in a function that accesses vectors, all of our tooling will report with total confidence that you’re overflowing a vector.</div><div><br class=""></div><div>That’s way worse than not having register state.</div><div><br class=""></div><div>-Filip</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">- Saam<br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">I believe that if you do want to analyze register state, then switching back to calling some function that prints out diagnostic information is strictly better. Sure, you get less register state, but at least you know where you crashed. Knowing where you crashed is much more important than knowing the register state, since the register state is not useful if you don’t know where you crashed.<br class=""><br class=""><blockquote type="cite" class=""><br class="">I also want the freedom to add RELEASE_ASSERT without ruining performance due to bad register allocation or making the code too large to inline. For example, hot paths in WTF::Vector use RELEASE_ASSERT.<br class=""></blockquote><br class="">Do we have data about the performance benefits of the current RELEASE_ASSERT implementation?<br class=""><br class=""><blockquote type="cite" class=""><br class="">Is some compromise solution possible?<br class=""><br class="">Some options:<br class=""><br class="">(1) Add a variant of RELEASE_ASSERT that takes a string and logs.<br class=""></blockquote><br class="">The point of C++ assert macros is that I don’t have to add a custom string. I want a RELEASE_ASSERT macro that automatically stringifies the expression and uses that as the string.<br class=""><br class="">If I had a choice between a RELEASE_ASSERT that can accurate report where it crashed but sometimes trashes the register state, and a RELEASE_ASSERT that always gives me the register state but cannot tell me which assert in the function it’s coming from, then I would always choose the one that can tell me where it crashed. That’s much more important, and the register state is not useful without that information.<br class=""><br class=""><blockquote type="cite" class=""><br class="">(2) Change RELEASE_ASSERT to do the normal debug ASSERT thing in Debug builds. (There’s not much need to preserve register state in debug builds.)<br class=""></blockquote><br class="">That would be nice, but doesn’t make RELEASE_ASSERT useful for debugging issues where timing is important. I no longer use RELEASE_ASSERTS for those kinds of assertions, because if I do it then I will never know where I crashed. So, I use the explicit:<br class=""><br class="">if (!thing) {<br class=""> dataLog(“…”);<br class=""> RELEASE_ASSERT_NOT_REACHED();<br class="">}<br class=""><br class="">-Filip<br class=""><br class=""><br class=""><blockquote type="cite" class=""><br class="">Geoff<br class=""><br class=""><blockquote type="cite" class="">On Feb 22, 2017, at 11:09 AM, Filip Pizlo <<a href="mailto:fpizlo@apple.com" class="">fpizlo@apple.com</a>> wrote:<br class=""><br class="">I disagree actually. I've lost countless hours to converting this:<br class=""><br class="">RELEASE_ASSERT(blah)<br class=""><br class="">into this:<br class=""><br class="">if (!blah) {<br class="">dataLog("Reason why I crashed");<br class="">RELEASE_ASSERT_NOT_REACHED();<br class="">}<br class=""><br class="">Look in the code - you'll find lots of stuff like this.<br class=""><br class="">I don't think analyzing register state at crashes is more important than keeping our code sane.<br class=""><br class="">-Filip<br class=""><br class=""><br class=""><blockquote type="cite" class="">On Feb 21, 2017, at 5:56 PM, Mark Lam <<a href="mailto:mark.lam@apple.com" class="">mark.lam@apple.com</a>> wrote:<br class=""><br class="">Oh yeah, I forgot about that. I think the register state is more important for crash analysis, especially if we can make sure that the compiler does not aggregate the int3s. I’ll explore alternatives.<br class=""><br class=""><blockquote type="cite" class="">On Feb 21, 2017, at 5:54 PM, Saam barati <<a href="mailto:sbarati@apple.com" class="">sbarati@apple.com</a>> wrote:<br class=""><br class="">I thought the main point of moving to SIGTRAP was to preserve register state?<br class=""><br class="">That said, there are probably places where we care more about the message than the registers.<br class=""><br class="">- Saam<br class=""><br class=""><blockquote type="cite" class="">On Feb 21, 2017, at 5:43 PM, Mark Lam <<a href="mailto:mark.lam@apple.com" class="">mark.lam@apple.com</a>> wrote:<br class=""><br class="">Is there a reason why RELEASE_ASSERT (and friends) does not call WTFReportAssertionFailure() to report where the assertion occur? Is this purely to save memory? svn blame tells me that it has been this way since the introduction of RELEASE_ASSERT in r140577 many years ago.<br class=""><br class="">Would anyone object to adding a call to WTFReportAssertionFailure() in RELEASE_ASSERT() like we do for ASSERT()? One of the upside (side-effect) of adding this call is that it appears to stop the compiler from aggregating all the RELEASE_ASSERTS into a single code location, and this will help with post-mortem crash debugging.<br class=""><br class="">Any thoughts?<br class=""><br class="">Mark<br class=""><br class="">_______________________________________________<br class="">webkit-dev mailing list<br class=""><a href="mailto:webkit-dev@lists.webkit.org" class="">webkit-dev@lists.webkit.org</a><br class=""><a href="https://lists.webkit.org/mailman/listinfo/webkit-dev" class="">https://lists.webkit.org/mailman/listinfo/webkit-dev</a><br class=""></blockquote><br class=""></blockquote><br class="">_______________________________________________<br class="">webkit-dev mailing list<br class=""><a href="mailto:webkit-dev@lists.webkit.org" class="">webkit-dev@lists.webkit.org</a><br class=""><a href="https://lists.webkit.org/mailman/listinfo/webkit-dev" class="">https://lists.webkit.org/mailman/listinfo/webkit-dev</a><br class=""></blockquote><br class="">_______________________________________________<br class="">webkit-dev mailing list<br class=""><a href="mailto:webkit-dev@lists.webkit.org" class="">webkit-dev@lists.webkit.org</a><br class=""><a href="https://lists.webkit.org/mailman/listinfo/webkit-dev" class="">https://lists.webkit.org/mailman/listinfo/webkit-dev</a><br class=""></blockquote><br class=""></blockquote><br class="">_______________________________________________<br class="">webkit-dev mailing list<br class=""><a href="mailto:webkit-dev@lists.webkit.org" class="">webkit-dev@lists.webkit.org</a><br class=""><a href="https://lists.webkit.org/mailman/listinfo/webkit-dev" class="">https://lists.webkit.org/mailman/listinfo/webkit-dev</a></div></div></blockquote></div></div></blockquote></div><br class=""></body></html>