Debugging assertion failures in torque

[Gus Caplan]

Hi. I'm seeing some an failure[1] in a torque change I'm working on[2] and I'm not sure how to debug where/why it is happening. I tried using lldb and gdb but they haven't been able to give any useful information either.

-Gus

[1]: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8875095098047201936/+/steps/Check/0/logs/basics/0

[2]: https://chromium-review.googlesource.com/c/v8/v8/+/2293709

[Seth Brenith]

I have two ideas.

First, the real fix: instead of emitting the current file and line number in the generated CSA, Torque should emit the entire stack of files and line numbers for all macros that are currently entered. That way we wouldn't get a message from just some deeply-nested tiny macro like Is<T> and wonder what other code was including it. I can add this to the Torque backlog if it's not already there.

Second, a possible workaround: assuming that gdb or lldb can at least tell you the name of the builtin and the current offset within it, you could try running mksnapshot with all of the normal args plus --print-code --code-comments, and looking at the disassembly for that builtin near that offset. Perhaps some nearby strings or code comments might give you a hint about the context.

[Gus Caplan]

I took a look around the disassembly. It seems (not 100% sure) like the failure is happening as part of the `new (Pretenured) WeakCell{}` call. Maybe I hooked the map up wrong? Not sure how allocating a T could fail Is<T>().

[Seth Brenith]

Have you gotten any help with this yet? I don't have a full answer for you, but I implemented the ability to print out the list of nested Torque macros at a failure (CL), and see the following:

abort: CSA_ASSERT failed: Torque assert 'Is<A>(o)' failed [src/builtins/cast.tq:622] [../../src/builtins/base.tq:1173] [../../src/builtins/finalization-registry.tq:166]

So the UnsafeCast in GetWeakCellMap is the one that's failing:

  return UnsafeCast<Map>(LoadNativeContext(context)

                             .elements[NativeContextSlot::WEAK_CELL_MAP_INDEX]);

[Gus Caplan]

I actually opened this bug earlier today: https://bugs.chromium.org/p/v8/issues/detail?id=10715

I guess my guess was wrong. I'll take a look at that map.

--
--
v8-dev mailing list
v8-...@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to a topic in the Google Groups "v8-dev" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/v8-dev/YgaFjYulOB8/unsubscribe.
To unsubscribe from this group and all its topics, send an email to v8-dev+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/v8-dev/9cc21f3a-2c8a-4891-b2ac-a9f3ef694a08o%40googlegroups.com.

[Gus Caplan]

It appears the object at WEAK_CELL_MAP_INDEX is the undefined constant, at least when this code runs. Is there some initialization I'm missing to be able to use it from Torque? Factory::NewWeakCell uses this map so it exists somehow...

[Seth Brenith]

Oh, I think I figured it out. Factory::NewWeakCell looks up the map in the roots array. The new Torque code looks up the map in the NativeContext. However, nobody ever called set_weak_cell_map on the NativeContext, so the NativeContext still thinks that the weak cell map is undefined. I don't see other examples of maps that are stored both in the roots array and in the NativeContext (both in STRONG_READ_ONLY_ROOTS_LIST and NATIVE_CONTEXT_FIELDS), so I would guess that it probably should not be in both lists. I can't tell how the things in STRONG_READ_ONLY_ROOTS_LIST get initialized, but I can see that the weak cell map exists there; I suppose macro magic must have created it. So my recommendation is to remove the weak_cell_map entry from NATIVE_CONTEXT_FIELDS, because it's confusing and wrong. Then we have to figure out how to get stuff from the roots array in Torque. It looks to me like if you add the weak cell map to UNIQUE_INSTANCE_TYPE_MAP_LIST_GENERATOR, then you can write `%GetClassMapConstant<WeakCell>()` in Torque and it should just work.

[Dan Elphick]

weak_cell_map is indeed added to the roots list via macro magic.

You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to v8-dev+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/v8-dev/be7682b3-c274-411f-93a9-567e7c5ba1fco%40googlegroups.com.