Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::RangeAnalysis::addRangeAssertions

RESOLVED FIXED in Firefox 47

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: gkw, Assigned: nbp)

Tracking

(Blocks: 2 bugs, {assertion, regression})

Trunk
mozilla47
x86_64
Linux
assertion, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox47 fixed)

Details

(Whiteboard: [jsbugmon:ignore])

Attachments

(6 attachments, 1 obsolete attachment)

(Reporter)

Description

2 years ago
+++ This bug was initially created as a clone of Bug #1244828 +++

Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default.

#0  js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=32) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281
#1  js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=32) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40
#2  js::jit::TempObject::operator new (nbytes=32, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174
#3  js::jit::RangeAnalysis::addRangeAssertions (this=0x7f80ecb99bd0) at /home/ubuntu/trees/mozilla-central/js/src/jit/RangeAnalysis.cpp:2314
#4  0x000000000069bbe3 in js::jit::OptimizeMIR (mir=0x39db810) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1733
#5  0x000000000069d703 in js::jit::CompileBackEnd (mir=0x39db810) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2008
#6  0x0000000000b14c3b in js::HelperThread::handleIonWorkload (this=0x308c5f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1276
#7  0x0000000000b14214 in js::HelperThread::threadLoop (this=0x308c5f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1603
#8  0x0000000000bfac2e in nspr::Thread::ThreadRoutine (arg=0x30a2240) at /home/ubuntu/trees/mozilla-central/js/src/vm/PosixNSPR.cpp:45
#9  0x00007f80f14476aa in start_thread (arg=0x7f80ecb9a700) at pthread_create.c:333
#10 0x00007f80f04bdeed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
(Assignee)

Comment 1

2 years ago
Created attachment 8715808 [details] [diff] [review]
Ensure enough ballast space in ::TruncateTest.
Attachment #8715808 - Flags: review?(hv1989)
(Assignee)

Comment 2

2 years ago
Created attachment 8715809 [details] [diff] [review]
Ensure enough ballast space in ::CloneForDeadBranches.
Attachment #8715809 - Flags: review?(hv1989)
(Assignee)

Comment 3

2 years ago
Created attachment 8715810 [details] [diff] [review]
Ensure enough ballast space in RangeAnalysis::truncate.
Attachment #8715810 - Flags: review?(hv1989)
(Assignee)

Comment 4

2 years ago
Created attachment 8715811 [details] [diff] [review]
Ensure enough ballast space in RangeAnalysis::tryHoistBoundsCheck.
Attachment #8715811 - Flags: review?(hv1989)
(Assignee)

Comment 5

2 years ago
Created attachment 8715812 [details] [diff] [review]
Ensure enough ballast space in RangeAnalysis::analyze.
Attachment #8715812 - Flags: review?(hv1989)
(Assignee)

Comment 6

2 years ago
Created attachment 8715813 [details] [diff] [review]
Ensure enough ballast space in RangeAnalysis::analyzeLoop.
Attachment #8715813 - Flags: review?(hv1989)
Attachment #8715808 - Flags: review?(hv1989) → review+
Attachment #8715809 - Flags: review?(hv1989) → review+
Attachment #8715810 - Flags: review?(hv1989) → review+
Comment on attachment 8715811 [details] [diff] [review]
Ensure enough ballast space in RangeAnalysis::tryHoistBoundsCheck.

Review of attachment 8715811 [details] [diff] [review]:
-----------------------------------------------------------------

This is incorrect. The return value here is not used to mark "OOM", but that trying to hoist bounds check failed.
Attachment #8715811 - Flags: review?(hv1989)
Attachment #8715812 - Flags: review?(hv1989) → review+
Attachment #8715813 - Flags: review?(hv1989) → review+
(Assignee)

Comment 8

2 years ago
Created attachment 8716925 [details] [diff] [review]
Ensure enough ballast space before RangeAnalysis::tryHoistBoundsCheck.
Attachment #8716925 - Flags: review?(hv1989)

Comment 9

2 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/794747093c1f
https://hg.mozilla.org/integration/mozilla-inbound/rev/632547643a74
https://hg.mozilla.org/integration/mozilla-inbound/rev/2e543fbdce6f
https://hg.mozilla.org/integration/mozilla-inbound/rev/d8c6f0bce77b
https://hg.mozilla.org/integration/mozilla-inbound/rev/e697c6ec64ad
https://hg.mozilla.org/integration/mozilla-inbound/rev/385f208a57bf

Comment 10

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/794747093c1f
https://hg.mozilla.org/mozilla-central/rev/632547643a74
https://hg.mozilla.org/mozilla-central/rev/2e543fbdce6f
https://hg.mozilla.org/mozilla-central/rev/d8c6f0bce77b
https://hg.mozilla.org/mozilla-central/rev/e697c6ec64ad
https://hg.mozilla.org/mozilla-central/rev/385f208a57bf
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox47: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
Attachment #8716925 - Flags: review?(hv1989) → review+
(Assignee)

Updated

2 years ago
Attachment #8715811 - Attachment is obsolete: true

Comment 11

2 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/93e0395f69fb

Comment 12

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/93e0395f69fb
You need to log in before you can comment on or make changes to this bug.