1245154 - Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::BacktrackingAllocator::mergeAndQueueRegisters

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

+++ This bug was initially created as a clone of Bug #1244828 +++

Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default.

Line numbers from m-c rev b2a3dc4b161f:

#0  js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=48) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281
#1  js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=48) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40
#2  js::jit::TempObject::operator new (nbytes=48, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174
#3  js::jit::LiveBundle::New (alloc=..., spill=<optimized out>, spillParent=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.h:421
#4  js::jit::BacktrackingAllocator::mergeAndQueueRegisters (this=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.cpp:1069
#5  0x0000000000df8b98 in js::jit::BacktrackingAllocator::go (this=0x7fc0c7cf0ea8) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.cpp:817
#6  0x00000000006a1f12 in js::jit::GenerateLIR (mir=0x4078240) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1941
#7  0x00000000006a2472 in js::jit::CompileBackEnd (mir=0x4078240) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2011
#8  0x0000000000b18218 in js::HelperThread::handleIonWorkload (this=0x1e8a3f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1276
#9  0x0000000000b177f4 in js::HelperThread::threadLoop (this=0x1e8a3f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1603
#10 0x0000000000bfe0be in nspr::Thread::ThreadRoutine (arg=0x1e8fbd0) at /home/ubuntu/trees/mozilla-central/js/src/vm/PosixNSPR.cpp:45
#11 0x00007fc0c93866aa in start_thread (arg=0x7fc0c7cf2700) at pthread_create.c:333
#12 0x00007fc0c83fceed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1

[Nicolas B. Pierron [:nbp]]

Attachment: Ensure enough ballast space in LiveBundle::New.

Comment 2

[Hannes Verschore [:h4writer]]

Comment on attachment 8716276 [details] [diff] [review]
Ensure enough ballast space in LiveBundle::New.

Review of attachment 8716276 [details] [diff] [review]:
-----------------------------------------------------------------

Like discussed on IRC: Add FallibleNew instead of using New here. ::New should be 'infallible' if there is enough ballast.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c52611492e87

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

I had to back this out for breaking asm tests in mochitest-1:

https://treeherder.mozilla.org/logviewer.html#?job_id=21287226&repo=mozilla-inbound
https://hg.mozilla.org/integration/mozilla-inbound/rev/b00d2d89aa01

Comment 5

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8716276 [details] [diff] [review]
Ensure enough ballast space in LiveBundle::New.

Review of attachment 8716276 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/BacktrackingAllocator.cpp
@@ +2882,5 @@
>          LiveRange* range = LiveRange::get(*iter);
>  
>          if (UseNewBundle(splitPositions, range->from(), &activeSplitPosition)) {
>              activeBundle = LiveBundle::New(alloc(), bundle->spillSet(), spillBundle);
> +            if (!activeBundle || newBundles.append(activeBundle))

self-nit (after backout):  There is a missing negation on this line which caused us to failed all compilations.

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c5ec75e94e6

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5c5ec75e94e6