1214846 - Assertion failure: cx->isExceptionPending(), at builtin/TestingFunctions.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

// Adapted from randomly chosen test: js/src/jit-test/tests/profiler/bug1211962.js
enableSPSProfiling();
var s = newGlobal();
s.offThreadCompileScript('oomTest(() => {});');
s.runOffThreadScript();

asserts js debug shell on m-c changeset 833c3c37daa6 with --fuzzing-safe --ion-offthread-compile=off --no-ion --no-baseline at Assertion failure: cx->isExceptionPending(), at builtin/TestingFunctions.cpp

Configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --disable-threadsafe --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 833c3c37daa6

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9c365490d4ce
user:        Jon Coppeard
date:        Tue Oct 13 13:37:07 2015 +0100
summary:     Bug 1212469 - Make oomTest() into a shell function r=nbp

Jon, is bug 1212469 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x10cb36, 0x0000000100427fed js-dbg-64-dm-darwin-833c3c37daa6`OOMTest(cx=0x0000000104045400, argc=<unavailable>, vp=0x0000000105224148) + 1453 at TestingFunctions.cpp:1158, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000100427fed js-dbg-64-dm-darwin-833c3c37daa6`OOMTest(cx=0x0000000104045400, argc=<unavailable>, vp=0x0000000105224148) + 1453 at TestingFunctions.cpp:1158
    frame #1: 0x0000000100670df2 js-dbg-64-dm-darwin-833c3c37daa6`js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [inlined] js::CallJSNative(cx=0x0000000104045400, native=(js-dbg-64-dm-darwin-833c3c37daa6`OOMTest(JSContext*, unsigned int, JS::Value*) at TestingFunctions.cpp:1097))(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) + 174 at jscntxtinlines.h:235
    frame #2: 0x0000000100670d44 js-dbg-64-dm-darwin-833c3c37daa6`js::Invoke(cx=0x0000000104045400, args=0x00007fff5fbfdb98, construct=<unavailable>) + 564 at Interpreter.cpp:784
    frame #3: 0x000000010068b355 js-dbg-64-dm-darwin-833c3c37daa6`Interpret(cx=<unavailable>, state=0x00007fff5fbfe0b8) + 48101 at Interpreter.cpp:3107
    frame #4: 0x000000010067f6f0 js-dbg-64-dm-darwin-833c3c37daa6`js::RunScript(cx=0x0000000104045400, state=0x00007fff5fbfe0b8) + 400 at Interpreter.cpp:725
(lldb)

Comment 2

[Nicolas B. Pierron [:nbp]]

Based on the test case, this might be a duplicate of Bug 1214781.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug1214846-off-thread-compile-oom

Make SPSProfiler::enter() report OOM to the context.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/33b06ee16442

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/33b06ee16442

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/33b06ee16442