1497107 - Assertion failure: fallibleScope_ ([OOM] Cannot allocate a new chunk in an infallible scope.), at js/src/ds/LifoAlloc.cpp:145

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Bob Clary [:bc] (inactive)]

Attachment: Windows logs for both urls

https://creatoracademy.youtube.com/page/course-exam/get-discovered?hl=en

or

https://variety.com/2018/film/reviews/putins-witnesses-review-1202866751/

Assertion failure: fallibleScope_ ([OOM] Cannot allocate a new chunk in an infallible scope.), at z:/build/build/src/js/src/ds/LifoAlloc.cpp:145

Bughunter found on Windows, I reproduced locally on Linux (may require reload). No crash on opt at least locally on Linux.

Comment 1

[Nicolas B. Pierron [:nbp]]

This is a debug-only assertion, which checks that we have a fallible allocator when we allocate new chunks. In release build this should crash only on actual OOM.

This bug should be actionable from the stack trace.

Comment 2

[Nicolas B. Pierron [:nbp]]

Iain, do you mind continuing on fixing these IonBuilder missing checks for ensureBalast?

Comment 3

[Iain Ireland [:iain]]

This bug looks much more tractable than my last ensureBallast bug.

The problem is IonBuilder::freezePropertiesForCommonPrototype: https://searchfox.org/mozilla-central/source/js/src/jit/IonBuilder.cpp#10401-10430

There are two nested loops. The outer loop iterates over the contents of a TemporaryTypeSet (in this case, with capacity 64). The inner loop walks up the prototype chain, calling isOwnProperty on each element. isOwnProperty allocates ~64 bytes each time it is called, and we call it nearly 400 times before running out of ballast (even though we had more than enough ballast when entering this function.)

The script that triggers the bug is on line 144 of this youtube webcomponents js: https://creatoracademy.youtube.com/frontend_polymer/js_redesign/webcomponentsjs/webcomponents-lite.js. I haven't made an effort at a cutdown testcase yet.

Awkwardly, freezePropertiesForCommonPrototype is a couple of levels deep in code that does not expect to be able to fail, so it will take a little bit of surgery to fix this.

Comment 4

[Iain Ireland [:iain]]

Attachment: Bug 1497107: Add ensureBallast call to freezePropertiesForCommonPrototype r?nbp

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/136188d4f928
Add ensureBallast call to freezePropertiesForCommonPrototype r=nbp

Comment 6

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/136188d4f928

Comment 7

[Sunday]

Wow never knew there is something like this on the internet, I appreciate it. It is amazing and wonderful. Now I will love to tell you about <a href="https://www.makeoverarena.com/waptrick-games-videos-mp3-download-www-waptrick-com/">Sports updates and also Games updates. </a>