1127581 - "Assertion failure: !empty()" with startgc, oomAfterAllocations

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: stack

startgc(0);
oomAfterAllocations(0);

Assertion failure: !empty(), at Vector.h:422

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This blocks fuzzing with oomAfterAllocations.

Comment 2

[Terrence Cole [:terrence]]

Steve, this looks like more fallout from the statistics changes.

Comment 3

[Steve Fink [:sfink] [:s:]]

Attachment: Do not clear slices when failing due to OOM

Well, it's sort of a regression from those changes. It's actually a problem in how I avoided an UnhandleableOOM, which would otherwise break a test. Perhaps I should just have annotated the test to accept a crash, though then it would stop testing what it was testing.

Anyway, it really expects slice 0 to exist, so I should stop wiping them out when seeing an OOM. With this patch, the test case crashes on (a different) UnhandleableOOM. I think that this will be ok for the fuzzers? The problem here was that the OOM was resulting in an out-of-bounds access crash.

Comment 4

[Terrence Cole [:terrence]]

Comment on attachment 8557229 [details] [diff] [review]
Do not clear slices when failing due to OOM

Review of attachment 8557229 [details] [diff] [review]:
-----------------------------------------------------------------

wfm

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/530d438655f7