1542279 - Assertion failure: newMaxNurseryChunks > 0, at js/src/gc/Nursery.cpp:1243

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 93075ec49df3 (build with --target=i686-pc-linux --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests --disable-cranelift, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

gcparam('maxNurseryBytes', 2 ** 32 - 1);

Backtrace:

#0 js::Nursery::maybeResizeExact (this=0xf6b1a190, reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/Nursery.cpp:1243
#1 0x57ed0d37 in js::Nursery::maybeResizeNursery (this=0xf6b1a190, reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/Nursery.cpp:1171
#2 0x57ecd94e in js::Nursery::collect (this=0xf6b1a190, reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/Nursery.cpp:795
#3 0x57e5366e in js::gc::GCRuntime::minorGC (this=0xf6b183e8, reason=JS::GCReason::DESTROY_RUNTIME, phase=js::gcstats::PhaseKind::EVICT_NURSERY_FOR_MAJOR_GC) at js/src/gc/GC.cpp:7828
#4 0x57e529e7 in js::gc::GCRuntime::gcCycle (this=0xf6b183e8, nonincrementalByAPI=<optimized out>, budget=..., reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/GC.cpp:7403
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/8aaeb14dfc0c
user: Paul Bone
date: Fri Mar 22 05:15:38 2019 +0000
summary: Bug 1531626 - (part 4) Always round-nearest for nursery size r=jonco

Paul, is bug 1531626 a likely regressor?

Comment 3

[Paul Bone [:pbone]]

Attachment: Bug 1542279 - Guard against overflow when calculating the new max chunks r?jonco

Comment 4

[Paul Bone [:pbone]]

Attachment: Bug 1542279 - Fix a problem with rounding down to zero r?jonco

Depends on D26462

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/142748fa228e
Guard against overflow when calculating the new max chunks r=jonco
https://hg.mozilla.org/integration/autoland/rev/8e4e52017c5d
Fix a problem with rounding down to zero r=jonco

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/142748fa228e
https://hg.mozilla.org/mozilla-central/rev/8e4e52017c5d