1504587 - Perma Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942 when Gecko merges to Beta on 2018-12-03

Status: VERIFIED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[Andreea Pavel [:apavel]]

[Tracking Requested - why for this release]:

Central as Beta simulation

The first occurrence was here: 

https://treeherder.mozilla.org/#/jobs?repo=try&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel%2Crunnable&revision=92d160caf64a1adff83a8667fdcc7dfd8abbb0f9&selectedJob=208868959

Reran here (initial push was too long ago for the task to be reran): https://treeherder.mozilla.org/#/jobs?repo=try&revision=658045845a5beee8ce27a6b00ccfb79302fda273&searchStr=windows%2C2012%2Cdebug%2Cspidermonkey%2Cbuilds%2Cspidermonkey-sm-compacting-win32%2Fdebug%2Csm%28cgc%29&selectedJob=209683670

This might be from bug 1447372, Ted can you please take a look? 
Failure log: 

https://treeherder.mozilla.org/logviewer.html#?job_id=209683670&repo=try&lineNumber=36070

TEST-PASS | js\src\jit-test\tests\gc\oomInRegExp.js | Success (code 0, args "") [0.3 s]
{"action": "test_start", "jitflags": "", "pid": 1932, "source": "jittests", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340445.83}
{"action": "test_end", "extra": {"jitflags": ""}, "jitflags": "", "message": "Success", "pid": 1932, "source": "jittests", "status": "PASS", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340446.125}
Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942
Exit code: -2147483645
FAIL - gc\oomInRegExp.js
TEST-UNEXPECTED-FAIL | js\src\jit-test\tests\gc\oomInRegExp.js | Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942 (code -2147483645, args "--ion-eager --ion-offthread-compile=off") [0.3 s]
{"action": "test_start", "jitflags": "--ion-eager --ion-offthread-compile=off", "pid": 1932, "source": "jittests", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340446.098}
{"action": "test_end", "extra": {"jitflags": "--ion-eager --ion-offthread-compile=off"}, "jitflags": "--ion-eager --ion-offthread-compile=off", "message": "Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942", "pid": 1932, "source": "jittests", "status": "FAIL", "test": "gc\\oomInRegExp.js", "thread": "main", "time": 1541340446.435}
INFO exit-status     : -2147483645
INFO timed-out       : False
INFO stderr         2> Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at z:/task_1541333047/src/js/src/builtin/TestingFunctions.cpp:1942
TEST-PASS | js\src\jit-test\tests\gc\oomInRegExp.js | Success (code 0, args "--baseline-eager") [0.3 s]

Comment 1

[Ted Campbell [:tcampbell]]

Haven't been able to reproduce locally yet, but this is on my radar still.

Comment 2

[Andreea Pavel [:apavel]]

(In reply to Ted Campbell [:tcampbell] from comment #1)
> Haven't been able to reproduce locally yet, but this is on my radar still.

I don't know if it helps but, this occurs only on win32/debug sm(cgc) and win32/debug sm(p) builds.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1504587 - Fix OOM bug in IonBuilder::inlineRegExpSearcher. r?nbp

We cleared the exception but then propagated the "we have a pending exception" AbortReason.
This makes inlineRegExpSearcher behave like inlineRegExpMatcher and inlineRegExpTester.

Comment 4

[Jan de Mooij [:jandem]]

I hit this perma-orange on Try with one of my patches so I investigated it.

It's still not clear to me why this is so hard to trigger with local builds (even on Windows) though.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cc6190a87a3b
Fix OOM bug in IonBuilder::inlineRegExpSearcher. r=nbp

Comment 6

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/cc6190a87a3b

Comment 7

[Cristina Coroiu [:ccoroiu]]

Verified fixed with this beta simulation:
https://treeherder.mozilla.org/#/jobs?repo=try&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel%2Crunnable&revision=c9f41275280347a0d12c7276ce9652f113b5812d