Closed
Bug 1298139
Opened 7 years ago
Closed 6 years ago
Crash [@ js::jit::BytecodeAnalysis::info]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla55
People
(Reporter: gkw, Assigned: jandem)
References
Details
(Keywords: bugmon, crash, testcase, Whiteboard: [jsbugmon:])
Crash Data
Attachments
(3 files)
The following testcase crashes on mozilla-central revision bd7645928990 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-loop-unrolling=on): // jsfunfuzz-generated oomTest( new Function("\ eval(\"\ /* Adapted from randomly chosen test: js/src/jit-test/tests/jaeger/recompile/memory-01.js */ \ (function() {\ for (var i = 0; i < 999; i++) {}\ })();\ \")\ ") ) Backtrace: 0 js-dbg-64-dm-clang-darwin-bd7645928990 0x000000010fd78204 js::jit::BytecodeAnalysis::info(unsigned char*) + 20 (BytecodeAnalysis.h:51) 1 js-dbg-64-dm-clang-darwin-bd7645928990 0x000000010fd5ac9d js::jit::MBasicBlock::inherit(js::jit::TempAllocator&, js::jit::BytecodeAnalysis*, js::jit::MBasicBlock*, unsigned int, unsigned int) + 429 (MIRGraph.cpp:531) 2 js-dbg-64-dm-clang-darwin-bd7645928990 0x000000010fd5aa88 js::jit::MBasicBlock::New(js::jit::MIRGraph&, js::jit::BytecodeAnalysis*, js::jit::CompileInfo const&, js::jit::MBasicBlock*, js::jit::BytecodeSite*, js::jit::MBasicBlock::Kind) + 520 (MIRGraph.cpp:274) 3 js-dbg-64-dm-clang-darwin-bd7645928990 0x000000010fcc8bc2 js::jit::UnrollLoops(js::jit::MIRGraph&, mozilla::Vector<js::jit::LoopIterationBound*, 0ul, js::SystemAllocPolicy> const&) + 1506 (LoopUnroller.cpp:215) 4 js-dbg-64-dm-clang-darwin-bd7645928990 0x000000010fc0c8fd js::jit::OptimizeMIR(js::jit::MIRGenerator*) + 5101 (Ion.cpp:1781) 5 js-dbg-64-dm-clang-darwin-bd7645928990 0x000000010fc17f13 js::jit::CompileBackEnd(js::jit::MIRGenerator*) + 67 (Ion.cpp:2025) /snip For detailed crash information, see attachment.
![]() |
Reporter | |
Comment 1•7 years ago
|
||
![]() |
Reporter | |
Comment 2•7 years ago
|
||
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/4b5c2c00f20a user: Nicolas B. Pierron date: Mon Jun 20 13:54:08 2016 +0000 summary: Bug 1264948 part 1 - Register if the LifoAlloc is supposed to be infallible or not. r=jonco,h4writer Nicolas, setting needinfo? from you again.
Blocks: 1264948
Flags: needinfo?(nicolas.b.pierron)
![]() |
Reporter | |
Comment 3•7 years ago
|
||
Updated•6 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Comment 4•6 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 8d9fd089cabd).
![]() |
Reporter | |
Updated•6 years ago
|
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Updated•6 years ago
|
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
Comment 5•6 years ago
|
||
JSBugMon: Fix Bisection requested, result: === Treeherder Build Bisection Results by autoBisect === The "good" changeset has the timestamp "20160504012947" and the hash "4f4c042c6d3a6d393b6b26f789fb087648a2cdcd". The "bad" changeset has the timestamp "20160504014445" and the hash "ecc70bad825e8702f2ee171ae89392887753c21c". Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4f4c042c6d3a6d393b6b26f789fb087648a2cdcd&tochange=ecc70bad825e8702f2ee171ae89392887753c21c
![]() |
Reporter | |
Comment 6•6 years ago
|
||
This issue is probably intermittent and comment 5 likely isn't accurate. Hannes, what do you think might be the issue here?
Flags: needinfo?(hv1989)
![]() |
Reporter | |
Comment 7•6 years ago
|
||
Hannes isn't likely to be active much going forward. Jan/Nicolas, what's next here?
Flags: needinfo?(hv1989) → needinfo?(jdemooij)
Assignee | ||
Comment 8•6 years ago
|
||
The loop unrolling code (disabled by default) needs to handle OOM properly. I can't reproduce this on tip so I didn't add the testcase.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(nicolas.b.pierron)
Flags: needinfo?(jdemooij)
Attachment #8869411 -
Flags: review?(nicolas.b.pierron)
Updated•6 years ago
|
Attachment #8869411 -
Flags: review?(nicolas.b.pierron) → review+
Pushed by jandemooij@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/3f347989ea45 Make LoopUnroller code handle OOM correctly. r=nbp
Comment 10•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/3f347989ea45
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
status-firefox55:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Updated•6 years ago
|
status-firefox51:
affected → ---
status-firefox53:
--- → disabled
status-firefox54:
--- → disabled
status-firefox-esr52:
--- → disabled
You need to log in
before you can comment on or make changes to this bug.
Description
•