Closed
Bug 917759
Opened 11 years ago
Closed 11 years ago
Assertion failure: !cx->isExceptionPending(), at jit/IonBuilder.cpp:3779 with OOM
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla27
Tracking | Status | |
---|---|---|
firefox26 | --- | affected |
People
(Reporter: decoder, Assigned: bhackett1024)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:])
Attachments
(1 file)
785 bytes,
text/plain
|
Details |
The following testcase asserts on mozilla-central revision ab4ccf3d6b60 (run with --fuzzing-safe --ion-eager): gcparam("maxBytes", gcparam("gcBytes") + 4*1024); function A(a) { this.a = a; } function B(b) { this.b = b; } function C(c) { this.c = c; } function makeArray(n) { var classes = [A, B, C]; var arr = []; for (var i = 0; i < n; i++) { arr.push(new classes[i % 3](i % 3)); } } var arr = makeArray(30000);
Reporter | ||
Comment 1•11 years ago
|
||
Reporter | ||
Comment 2•11 years ago
|
||
Just hit this OOM error again and since the other isExceptionPending assertion has been fixed, this must be something new.
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 3•11 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/67e44e98555c user: Hannes Verschore date: Fri Jan 04 17:11:32 2013 +0100 summary: Bug 825705: Creating this on caller-side shouldn't query prototype for unknown objects, r=jandem This iteration took 124.057 seconds to run.
Comment 5•11 years ago
|
||
Kannan, can you have a look? I think we have an pending exception in the parent before inlining. At least I see no reason why that wouldn't be possible. So this assert needs to get deleted, maybe handled like the check you introduced after inlining?
Flags: needinfo?(hv1989) → needinfo?(kvijayan)
Comment 6•11 years ago
|
||
(In reply to Christian Holler (:decoder) from comment #4) > Hannes, can you look at this one? Sorry about the delay in checking this, but was on Holiday...
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Reporter | ||
Comment 7•11 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision ddd03c32fab1).
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Comment 8•11 years ago
|
||
Is it normal it takes so long to bisect the range to find the fix?
Flags: needinfo?(choller)
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
Reporter | ||
Comment 9•11 years ago
|
||
JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/f613d7363bd2 user: Brian Hackett date: Mon Oct 14 12:13:41 2013 -0600 summary: Bug 924611 - Don't create lazy type objects and type properties in IonBuilder, r=jandem. This iteration took 417.636 seconds to run.
Updated•11 years ago
|
Flags: needinfo?(choller) → needinfo?(hv1989)
Comment 10•11 years ago
|
||
Brian: do you think this could have solved this issue? I don't see a change that could be linked with the introduction of the bug. Or do you think this has only hidden the problem?
Flags: needinfo?(kvijayan)
Flags: needinfo?(hv1989)
Flags: needinfo?(bhackett1024)
Assignee | ||
Comment 11•11 years ago
|
||
Yeah, since IonBuilder doesn't use a cx anymore except for limited cases in the definite properties analysis it doesn't create many exceptions anymore.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → FIXED
Reporter | ||
Updated•11 years ago
|
status-firefox26:
--- → affected
Updated•11 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•