1305739 - Assertion failure: cx->isExceptionPending() running testcase from bug 1269755 with --ion-eager

Status: RESOLVED DUPLICATE of bug 1364908

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Jon Coppeard (:jonco)]

The following testcase fails when run with: --ion-eager --ion-offthread-compile=off

oomTest(function() { eval(`
   for (y = 0; y < 3; y++ ) {
    SignedRightShift(y );
  }
function Mask( b, n ) {
  b = ToUint32BitString( b );
  b = b.substring( b.length - n );
  b = "0" + b;
}
function ToUint32BitString( n ) {
  var b = "";
  for ( var p = 0; p < 29; p++ ) {
      b += "0";
  }
  return b;
}
function SignedRightShift(a ) {
  a = Mask( a, 5 );
}
`)});

For some reason it seems to depend on the path of the testcase, with an longer absolute path failing every time, but a relative path not:

~/clone/dev/js/src$ ./optdebug-build/shell --ion-eager --ion-offthread-compile=off testcase.js
~/clone/dev/js/src$ ./optdebug-build/shell --ion-eager --ion-offthread-compile=off /home/jon/clone/dev/js/src/testcase.js
Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at /home/jon/clone/dev/js/src/builtin/TestingFunctions.cpp:1373
Segmentation fault (core dumped)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jon, which changeset does this reproduce on? I tried with an absolute path on m-c tip rev d02d14a3dd6e with --enable-debug, but failed to reproduce this.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I also retried on rev 560b2c805bf7 which is what was referenced in bug 1269755 comment 4, but couldn't reproduce with --ion-eager.

=> WFM

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Reopening for Iain to recheck, since he could reproduce bug 1066759 and I (initially) couldn't.

Comment 4

[Iain Ireland [:iain]]

I could reproduce this in rev 560b2c805bf7, but not in central. Looking at it in RR, the last OOM before crashing -- that is, the one that failed to call ReportOutOfMemory -- was this allocation in PrepareOSRTempData.

Nicolas added a call to ReportOutOfMemory as part of bug 1364908.

Closing as duplicate.