1245155 - Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::LiveRange::New

Status: RESOLVED DUPLICATE of bug 1243397

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

+++ This bug was initially created as a clone of Bug #1244828 +++

Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default.

Line numbers from m-c rev b2a3dc4b161f:

#0  js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=72) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281
#1  js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=72) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40
#2  js::jit::TempObject::operator new (nbytes=72, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174
#3  js::jit::LiveRange::New (vreg=<optimized out>, alloc=..., from=..., to=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.h:274
#4  js::jit::LiveBundle::addRangeAndDistributeUses (this=0x7d3e5d0, alloc=..., oldRange=<optimized out>, from=..., to=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.cpp:205
#5  0x0000000000e014d7 in js::jit::BacktrackingAllocator::trySplitAcrossHotcode (this=0x7fe38d121ea8, bundle=0x7d380f0, success=0x7fe38d121d07) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.cpp:2595
#6  0x0000000000dff609 in js::jit::BacktrackingAllocator::chooseBundleSplit (this=0x7fe38d121ea8, bundle=0x7d380f0, fixed=true, conflict=0x0) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.cpp:3014
#7  0x0000000000dfb0c4 in js::jit::BacktrackingAllocator::processBundle (this=0x7fe38d121ea8, bundle=0x7d380f0) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.cpp:1302
#8  0x0000000000df9df4 in js::jit::BacktrackingAllocator::go (this=0x7fe38d121ea8) at /home/ubuntu/trees/mozilla-central/js/src/jit/BacktrackingAllocator.cpp:831
#9  0x00000000006a1f32 in js::jit::GenerateLIR (mir=0x78f5f50) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1941
#10 0x00000000006a2492 in js::jit::CompileBackEnd (mir=0x78f5f50) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2011
#11 0x0000000000b194b8 in js::HelperThread::handleIonWorkload (this=0x305f9f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1276
#12 0x0000000000b18a94 in js::HelperThread::threadLoop (this=0x305f9f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1603
#13 0x0000000000bff4fe in nspr::Thread::ThreadRoutine (arg=0x3070ca0) at /home/ubuntu/trees/mozilla-central/js/src/vm/PosixNSPR.cpp:45
#14 0x00007fe390dca6aa in start_thread (arg=0x7fe38d123700) at pthread_create.c:333
#15 0x00007fe38fe40eed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1

[Nicolas B. Pierron [:nbp]]

This should be fixed by Bug 1243397, which makes LiveRange::New fallible.