1247889 - Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::CodeGenerator::generateBody

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default.

Line numbers from m-c rev 2dfb45d74f42:

#0  js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281
#1  js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40
#2  0x000000000056bbb0 in js::jit::TempObject::operator new (nbytes=48, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174
#3  js::jit::CodeGenerator::visitInterruptCheck (this=0x7fc5ab169010, lir=0x7fc5ab0bc608) at /home/ubuntu/trees/mozilla-central/js/src/jit/CodeGenerator.cpp:10592
#4  0x00000000005533b1 in js::jit::CodeGenerator::generateBody (this=0x7fc5ab169010) at /home/ubuntu/trees/mozilla-central/js/src/jit/CodeGenerator.cpp:4682
#5  0x0000000000561ae2 in js::jit::CodeGenerator::generate (this=0x7fc5ab169010) at /home/ubuntu/trees/mozilla-central/js/src/jit/CodeGenerator.cpp:8398
#6  0x000000000057ffa9 in js::jit::GenerateCode (mir=0x6758a10, lir=0x7fc5ab100c70) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1978
#7  0x0000000000838212 in js::HelperThread::handleIonWorkload (this=0x22111e8) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1276
#8  0x0000000000837c5e in js::HelperThread::threadLoop (this=0x22111e8) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1603
#9  0x00000000008d6209 in nspr::Thread::ThreadRoutine (arg=0x22178f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/PosixNSPR.cpp:45
#10 0x00007fc6209076aa in start_thread (arg=0x7fc61ee71700) at pthread_create.c:333
#11 0x00007fc61f97deed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Alternative stack:

Line numbers from m-c rev 576a6dcde5b6:

#0  js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281
#1  js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40
#2  0x0000000000712333 in js::jit::TempObject::operator new (nbytes=40, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174
#3  js::jit::CodeGeneratorX86Shared::bailout<js::jit::BailoutJump> (this=0x7f540ff697a0, binder=..., snapshot=0x7f5426ead690) at /home/ubuntu/trees/mozilla-central/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp:541
#4  0x00000000006f2044 in js::jit::CodeGeneratorX86Shared::bailoutIf (this=0x7f542c2f5640 <_IO_2_1_stderr_>, condition=<optimized out>, snapshot=0x0) at /home/ubuntu/trees/mozilla-central/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp:550
#5  0x0000000000555c11 in js::jit::CodeGenerator::generateBody (this=0x7f540ff697a0) at /home/ubuntu/trees/mozilla-central/js/src/jit/CodeGenerator.cpp:4682
#6  0x0000000000564269 in js::jit::CodeGenerator::generate (this=0x7f540ff697a0) at /home/ubuntu/trees/mozilla-central/js/src/jit/CodeGenerator.cpp:8397
#7  0x0000000000582c07 in js::jit::GenerateCode (mir=0x2faf7e0, lir=0x7f5426f250f0) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1978
#8  0x000000000083ea2a in js::HelperThread::handleIonWorkload (this=0x19a3f20) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1276
#9  0x000000000083e45e in js::HelperThread::threadLoop (this=0x19a3f20) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1603
#10 0x00000000008dacae in nspr::Thread::ThreadRoutine (arg=0x19a7650) at /home/ubuntu/trees/mozilla-central/js/src/vm/PosixNSPR.cpp:45
#11 0x00007f542cfc06aa in start_thread (arg=0x7f542bf2f700) at pthread_create.c:333
#12 0x00007f542c036eed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 2

[Nicolas B. Pierron [:nbp]]

Attachment: Ensure enough ballast space in CodeGenerator::generateBody.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cfa9883c56b6

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/cfa9883c56b6