Closed Bug 1504587 Opened 2 years ago Closed 2 years ago

Perma Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942 when Gecko merges to Beta on 2018-12-03

Categories

(Core :: JavaScript: Standard Library, defect)

defect
Not set
normal

Tracking

()

VERIFIED FIXED
mozilla65
Tracking Status
firefox-esr60 --- unaffected
firefox63 --- unaffected
firefox64 --- unaffected
firefox65 + verified

People

(Reporter: apavel, Assigned: jandem)

References

Details

Attachments

(1 file)

[Tracking Requested - why for this release]:

Central as Beta simulation

The first occurrence was here: 

https://treeherder.mozilla.org/#/jobs?repo=try&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel%2Crunnable&revision=92d160caf64a1adff83a8667fdcc7dfd8abbb0f9&selectedJob=208868959

Reran here (initial push was too long ago for the task to be reran): https://treeherder.mozilla.org/#/jobs?repo=try&revision=658045845a5beee8ce27a6b00ccfb79302fda273&searchStr=windows%2C2012%2Cdebug%2Cspidermonkey%2Cbuilds%2Cspidermonkey-sm-compacting-win32%2Fdebug%2Csm%28cgc%29&selectedJob=209683670

This might be from bug 1447372, Ted can you please take a look? 
Failure log: 

https://treeherder.mozilla.org/logviewer.html#?job_id=209683670&repo=try&lineNumber=36070

TEST-PASS | js\src\jit-test\tests\gc\oomInRegExp.js | Success (code 0, args "") [0.3 s]
{"action": "test_start", "jitflags": "", "pid": 1932, "source": "jittests", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340445.83}
{"action": "test_end", "extra": {"jitflags": ""}, "jitflags": "", "message": "Success", "pid": 1932, "source": "jittests", "status": "PASS", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340446.125}
Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942
Exit code: -2147483645
FAIL - gc\oomInRegExp.js
TEST-UNEXPECTED-FAIL | js\src\jit-test\tests\gc\oomInRegExp.js | Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942 (code -2147483645, args "--ion-eager --ion-offthread-compile=off") [0.3 s]
{"action": "test_start", "jitflags": "--ion-eager --ion-offthread-compile=off", "pid": 1932, "source": "jittests", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340446.098}
{"action": "test_end", "extra": {"jitflags": "--ion-eager --ion-offthread-compile=off"}, "jitflags": "--ion-eager --ion-offthread-compile=off", "message": "Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942", "pid": 1932, "source": "jittests", "status": "FAIL", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340446.435}
INFO exit-status     : -2147483645
INFO timed-out       : False
INFO stderr         2> Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942
TEST-PASS | js\src\jit-test\tests\gc\oomInRegExp.js | Success (code 0, args "--baseline-eager") [0.3 s]
Flags: needinfo?(tcampbell)
Summary: Perma Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942 when Gecko merges to Beta on 2018-12-0 → Perma Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942 when Gecko merges to Beta on 2018-12-03
Haven't been able to reproduce locally yet, but this is on my radar still.
(In reply to Ted Campbell [:tcampbell] from comment #1)
> Haven't been able to reproduce locally yet, but this is on my radar still.

I don't know if it helps but, this occurs only on win32/debug sm(cgc) and win32/debug sm(p) builds.
We cleared the exception but then propagated the "we have a pending exception" AbortReason.
This makes inlineRegExpSearcher behave like inlineRegExpMatcher and inlineRegExpTester.
I hit this perma-orange on Try with one of my patches so I investigated it.

It's still not clear to me why this is so hard to trigger with local builds (even on Windows) though.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(tcampbell)
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/cc6190a87a3b
Fix OOM bug in IonBuilder::inlineRegExpSearcher. r=nbp
https://hg.mozilla.org/mozilla-central/rev/cc6190a87a3b
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
You need to log in before you can comment on or make changes to this bug.