1129314 - Assertion failure: !empty(), at dist/include/mozilla/Vector.h involving oomAfterAllocations

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

oomAfterAllocations(0);
gcslice(12);

asserts js debug shell on m-c changeset 58e4264903ba with --fuzzing-safe --no-threads --no-baseline --no-ion at Assertion failure: !empty(), at dist/include/mozilla/Vector.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Jon/Terrence, any idea what's going on here? (fwiw stable oomAfterAllocations support was only just implemented)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x66f5d, 0x0000000100881cd4 js-dbg-64-dm-nsprBuild-darwin-58e4264903ba`mozilla::VectorBase<js::gcstats::Statistics::SliceData, 8ul, js::SystemAllocPolicy, js::Vector<js::gcstats::Statistics::SliceData, 8ul, js::SystemAllocPolicy> >::back(this=<unavailable>) + 196 at Vector.h:422, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000100881cd4 js-dbg-64-dm-nsprBuild-darwin-58e4264903ba`mozilla::VectorBase<js::gcstats::Statistics::SliceData, 8ul, js::SystemAllocPolicy, js::Vector<js::gcstats::Statistics::SliceData, 8ul, js::SystemAllocPolicy> >::back(this=<unavailable>) + 196 at Vector.h:422
    frame #1: 0x00000001007aa0f5 js-dbg-64-dm-nsprBuild-darwin-58e4264903ba`js::gc::GCRuntime::resetIncrementalGC(char const*) [inlined] js::gcstats::Statistics::reset(reason=0x000000010142fea8) + 12 at Statistics.h:172
    frame #2: 0x00000001007aa0e9 js-dbg-64-dm-nsprBuild-darwin-58e4264903ba`js::gc::GCRuntime::resetIncrementalGC(this=0x000000010201fb30, reason=0x000000010142fea8) + 1065 at jsgc.cpp:5686
    frame #3: 0x00000001007ab5a0 js-dbg-64-dm-nsprBuild-darwin-58e4264903ba`js::gc::GCRuntime::gcCycle(this=0x000000010201fb30, incremental=<unavailable>, budget=0x00007fff5fbff178, reason=DESTROY_CONTEXT) + 320 at jsgc.cpp:6032
    frame #4: 0x00000001007abe68 js-dbg-64-dm-nsprBuild-darwin-58e4264903ba`js::gc::GCRuntime::collect(this=0x000000010201fb30, incremental=false, budget=(deadline = 9223372036854775807, counter = 9223372036854775807), reason=COMPARTMENT_REVIVED) + 840 at jsgc.cpp:6171
(lldb)

Comment 2

[Terrence Cole [:terrence]]

More fallout from Steve's statistics changes.

Comment 3

[Steve Fink [:sfink] [:s:]]

Attachment: On OOM, abort the stats collection entirely

Man, this is the gift that keeps on giving.

This patch fixes the problem in this bug (it changes to an unhandlable OOM), as well as the jsapi-tests bug that terrence reported over IRC. When first we practice to deceive... all of this is fallout from my "fixing" of an unhandlable OOM by remembering that our current stats collection is botched and continuing on without it. Perhaps I shouldn't even bother, and I should instead kill or modify the original failing test. (Or mark the stats allocations as invulnerable to oomAfterAllocations. Or something.)

But hey, unhandlable OOMs suck. So I'll keep trying for now.

Comment 4

[Terrence Cole [:terrence]]

Comment on attachment 8559599 [details] [diff] [review]
On OOM, abort the stats collection entirely

Review of attachment 8559599 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/gc/Statistics.cpp
@@ +902,5 @@
>  Statistics::printStats()
>  {
> +    if (aborted) {
> +        if (fullFormat)
> +            fprintf(fp, "GC aborted\n");

This message is going to sow confusion. Let's say something like "The GC::Statistics subsystem hit an OOM and had to threw its slices overboard in order to stay afloat."

Comment 5

[Steve Fink [:sfink] [:s:]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ad796c7bd98a

Comment 6

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/ad796c7bd98a