Closed Bug 1233786 Opened 7 years ago Closed 7 years ago

Enabling branch pruning cause oomTest failure.

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla46
Tracking Status
firefox46 --- fixed

People

(Reporter: nbp, Unassigned)

References

Details

Attachments

(1 file)

While enabling branch pruning by default, I noticed a oomTest failure caused by the allocation of the PCCounts under Baseline compilation.

Either we should report an exception, or ignore the fact that we are unable to allocate code coverage information.  I am more inclined to ignore the lack of code coverage allocation, as the JS engine should still be able to work even if we have no coverage info.

(gdb) bt
#0  js::oom::ShouldFailWithOOM () at ../../dist/include/js/Utility.h:143
#1  0x0000000000afbf1c in js_malloc (bytes=16) at ../../dist/include/js/Utility.h:220
#2  0x0000000000b288c3 in js_pod_malloc<js::PCCounts> (numElems=1) at ../../dist/include/js/Utility.h:407
#3  0x0000000000b4d428 in js::SystemAllocPolicy::maybe_pod_malloc<js::PCCounts> (this=0x7fffd17c81d0, numElems=1) at /home/nicolas/mozilla/wksp-4-dev/js/src/jsalloc.h:34
#4  0x0000000000b48775 in js::SystemAllocPolicy::pod_malloc<js::PCCounts> (this=0x7fffd17c81d0, numElems=1) at /home/nicolas/mozilla/wksp-4-dev/js/src/jsalloc.h:39
#5  0x0000000000b414b7 in mozilla::Vector<js::PCCounts, 0ul, js::SystemAllocPolicy>::convertToHeapStorage (this=0x7fffd17c81d0, aNewCap=1) at ../../dist/include/mozilla/Vector.h:798
#6  0x0000000000b3b223 in mozilla::Vector<js::PCCounts, 0ul, js::SystemAllocPolicy>::growStorageBy (this=0x7fffd17c81d0, aIncr=1) at ../../dist/include/mozilla/Vector.h:889
#7  0x0000000000b335f8 in mozilla::Vector<js::PCCounts, 0ul, js::SystemAllocPolicy>::reserve (this=0x7fffd17c81d0, aRequest=1) at ../../dist/include/mozilla/Vector.h:923
#8  0x0000000000aff7f4 in JSScript::initScriptCounts (this=0x7fe6465683d0, cx=0x263a850) at /home/nicolas/mozilla/wksp-4-dev/js/src/jsscript.cpp:1402
#9  0x0000000000eaf7a4 in js::jit::BaselineCompiler::compile (this=0x7fffd17c8830) at /home/nicolas/mozilla/wksp-4-dev/js/src/jit/BaselineCompiler.cpp:101
#10 0x0000000000683f61 in js::jit::BaselineCompile (cx=0x263a850, script=0x7fe6465683d0, forceDebugInstrumentation=false) at /home/nicolas/mozilla/wksp-4-dev/js/src/jit/BaselineJIT.cpp:279
[…]
This patch goes against my previous preference of ignoring allocation
failure. (1) This is less variable state to deal with. (2) All calls of
initScriptCounts are already considering it as an error.
Attachment #8700696 - Flags: review?(bhackett1024)
Attachment #8700696 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/f7f7f81ce57b
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla46
You need to log in before you can comment on or make changes to this bug.