Hit MOZ_CRASH(Failed to allocate profile string) at js/src/jit/JitScript.cpp:197
Categories
(Core :: JavaScript Engine: JIT, defect, P1)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr60 | --- | unaffected |
firefox-esr68 | --- | unaffected |
firefox68 | --- | unaffected |
firefox69 | --- | wontfix |
firefox70 | --- | fixed |
People
(Reporter: gkw, Assigned: jandem)
References
(Regression)
Details
(4 keywords, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
The following testcase crashes on mozilla-central revision 2b1bee2c7734 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-ion):
// jsfunfuzz-generated
(function exploreBuiltins() {
function exploreDeeper(a, an) {
try {
h = a[hn];
} catch (e) {}
}
function exploreConstructors() {
var gns = Object.getOwnPropertyNames(this);
for (var i = 0; i < gns.length; ++i) {
var gn = gns[i];
var g = this[gn];
if (typeof g === "function" && g.toString().indexOf("]") !== -1) {
exploreDeeper(g.prototype, `${gn}.prototype`);
}
}
}
exploreConstructors();
})();
function makeAsmJSFunction(d, b) {
handlerFactoryText += ")";
}
var recursiveFunctions = [{
text: "function g(){}",
},
{
text: "function g(){@}",
}
];
for (var i = 0; i < 2; ++i) {
var a = recursiveFunctions[i];
var text = a.text;
eval(text.replace(/@/g, "")); /* eslint-disable-line no-eval */
}
makeBuilderStatement = function(d, b) {};
var asmvals = [
1, Math.PI, 42,
];
var pureForeign = {}
var confusableVals = [];
// Adapted from randomly chosen test: js/src/jit-test/tests/parser/bug-1263355-44.js
oomTest(async function() {
enableGeckoProfiling();
})
Backtrace:
#0 js::jit::JitScript::ensureProfileString (this=0x7fd602939000, cx=<optimized out>, script=<optimized out>) at js/src/jit/JitScript.cpp:197
#1 0x000055d4c8a30225 in js::jit::ToggleBaselineProfiling (cx=<optimized out>, enable=<optimized out>) at js/src/jit/BaselineJIT.cpp:1065
#2 0x000055d4c81a6797 in js::GeckoProfilerRuntime::enable (this=<optimized out>, enabled=true) at js/src/vm/GeckoProfiler.cpp:119
#3 0x000055d4c7ec0e03 in EnableGeckoProfiling (cx=0x7fd603117000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:6627
#4 0x000055d4c7f6aff5 in CallJSNative (cx=0x7fd603117000, native=0x55d4c7ec0d30 <EnableGeckoProfiling(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:448
#5 0x000055d4c7f5ae9f in js::InternalCallOrConstruct (cx=<optimized out>, args=..., construct=<optimized out>) at js/src/vm/Interpreter.cpp:540
/snip
For detailed crash information, see attachment.
Setting s-s as a start as it is a JIT bug. However, it involves profiling via enableGeckoProfiling, so I'm now in not-sure territory.
Reporter | ||
Comment 1•5 years ago
|
||
Reporter | ||
Comment 2•5 years ago
|
||
autobisectjs shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/ce56e2779818
user: Jan de Mooij
date: Fri Jun 21 16:13:48 2019 +0000
summary: Bug 1551499 - Support Baseline Interpreter code in the profiler. r=djvj
Jan, is bug 1551499 a likely regressor?
Assignee | ||
Comment 3•5 years ago
|
||
That MOZ_CRASH should be an AutoEnterOOMUnsafeRegion. I should have seen that.
Updated•5 years ago
|
Updated•5 years ago
|
Assignee | ||
Comment 4•5 years ago
|
||
Assignee | ||
Updated•5 years ago
|
Updated•5 years ago
|
Comment 5•5 years ago
|
||
Jan - this looks ready to land; is anything blocking it? Will you be requesting uplift to 69?
Assignee | ||
Comment 6•5 years ago
|
||
(In reply to Randell Jesup [:jesup] (needinfo me) from comment #5)
Jan - this looks ready to land; is anything blocking it? Will you be requesting uplift to 69?
Thanks for the ping. I'll land this today and request uplift.
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/e0fb78ca5c55 Use AutoEnterOOMUnsafeRegion in JitScript::ensureProfileString. r=djvj
Comment 8•5 years ago
|
||
bugherder |
Assignee | ||
Comment 9•5 years ago
•
|
||
Actually since the browser behavior is exactly the same with or without the patch (a crash when OOM when enabling the profiler) I think this can just ride the trains.
Description
•