1527155 - Assertion failure: isThrowingOutOfMemory(), at js/src/vm/JSContext.cpp:1162 with BigInt

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision b9187fa10f13 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

See attachment.

Backtrace:

#0 JSContext::alreadyReportedOOM (this=0x7ffa36d17000) at js/src/vm/JSContext.cpp:1162
#1 0x000055ea5f59cebb in js::StringToBigInt (cx=0x7ffa36d17000, str=...) at /home/ubuntu/shell-cache/js-dbg-64-dm-linux-x86_64-b9187fa10f13/objdir-js/dist/include/mozilla/Maybe.h:443
#2 0x000055ea5f59c5f9 in js::ToBigInt (cx=0x7ffa36d17000, val=...) at js/src/vm/BigIntType.cpp:2633
#3 0x000055ea5f7e2448 in BigIntConstructor (cx=0x7ffa36d17000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/BigInt.cpp:47
#4 0x000055ea5f57e300 in CallJSNative (cx=0x7ffa36d17000, native=0x55ea5f7e22f0 <BigIntConstructor(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:442
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/4b74d76e55a8
user: Andy Wingo
date: Wed Feb 06 13:41:56 2019 +0000
summary: Bug 1522436 - Enable BigInt compilation by default r=jandem,terpri,froydnj

Andy, again related to BigInt?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The testcase seems to be resistant against further line-based reduction so I just went ahead to file for good measure...

Comment 5

[Robin Templeton [:terpri]]

a smaller testcase: BigInt(String(Array(0x100000)))

Comment 6

[Andy Wingo [:wingo]]

Attachment: Bug 1527155 - Uniformly signal OOM if StringToBigInt result too large

Comment 7

[Andy Wingo [:wingo]]

Attached patch fixes the error. Thanks for the report gkw!

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9ae214a9c414
Uniformly signal OOM if StringToBigInt result too large r=jwalden,terpri

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/9ae214a9c414