1513266 - Crash with ReadableStream and oomTest

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[Jason Orendorff [:jorendorff]]

// |jit-test| --no-ion; --no-baseline

function test() {
  let controller;
  let stream = new ReadableStream({
    start(c) {}
  });
  stream.getReader();  // <-- if we oom at a certain point in here,
  drainJobQueue();     // <-- we'll crash in here trying to fire start()
}

// Force lazy parsing to happen before oomTest starts.
//
// By design, oomTest expects the testing-function to follow the same code path
// each time it is called, right up to the point where OOM occurs. If on
// iteration 70 we finish and cache a unit of work that saves 65 allocations
// the next time we run, then the subsequent 65 allocation points go untested.
// (In this test, that means the entire part of the test we care about.)
//
// Things in this category include lazy parsing and basline compilation;
// we avoid the first by calling the test function once first, and the second
// by disabling the jits with a mode line.
test();

oomTest(test, {verbose: true, keepFailing: false});

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: Bug 1513266 - Part 1: Trivial fixes for oomTest. r?jwalden

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: Bug 1513266 - Part 2: Fix OOM crash in ReadableStream. r?jwalden

Depends on D14167

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f0431c25de7f
Part 1: Trivial fixes for oomTest. r=jwalden
https://hg.mozilla.org/integration/autoland/rev/06ca846a54c0
Part 2: Fix OOM crash in ReadableStream. r=jwalden

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f0431c25de7f
https://hg.mozilla.org/mozilla-central/rev/06ca846a54c0