1703481 - Crash in [@ OOM | unknown | js::AutoEnterOOMUnsafeRegion::crash | js::MovableCellHasher<T>::hash]

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Distribution is ~50% for each of Windows 7 & 10, 80% for 32-bit and 20% for 64-bit. THere are 30-60 crashes per 88 beta version.

Crash report: https://crash-stats.mozilla.org/report/index/d0ab2392-5ce1-4d7b-97ae-b72150210406

MOZ_CRASH Reason: [unhandlable oom] failed to allocate uid

Top 10 frames of crashing thread:

0 libxul.so js::AutoEnterOOMUnsafeRegion::crash js/src/vm/JSContext.cpp:1193
1 libxul.so js::MovableCellHasher<JSObject*>::hash js/src/gc/Barrier.cpp:231
2 libxul.so js::EmptyShape::getInitialShape js/src/vm/Shape.cpp:1979
3 libxul.so js::NewObjectWithGivenTaggedProto js/src/vm/JSObject.cpp:849
4 libxul.so js::CreateThisForFunction js/src/vm/PlainObject.cpp:46
5 libxul.so MaybeCreateThisForConstructor js/src/vm/Interpreter.cpp:324
6 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:541
7 libxul.so InternalConstruct js/src/vm/Interpreter.cpp:627
8 libxul.so js::ConstructFromStack js/src/vm/Interpreter.cpp:670
9 libxul.so js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:1821

Comment 1

[Jan de Mooij [:jandem]]

It's easy to fix this OOM by using hasHash and ensureHash in InitialShapeEntry, but I think that mechanism results in doing the unique-id lookup twice! This code path is pretty hot and I don't think that's worth the overhead.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

This is still high enough volume that we should keep it on the radar to fix as soon as possible. That said, it looks unlikely to be for 88 at this point.

Comment 3

[Jan de Mooij [:jandem]]

I'm looking into this to see if there's a way to fix this OOM without it either affecting performance or becoming really complicated.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 1703481 - Ensure proto object has a unique id when setting the IsUsedAsPrototype flag. r?jonco!

This way we only do the duplicate lookup the first time an object is used as prototype.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/46f7a204fe42
Ensure proto object has a unique id when setting the IsUsedAsPrototype flag. r=jonco

Comment 6

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/46f7a204fe42

Comment 7

[Pascal Chevrel (relman team) -> :pascalc]

Jan, is that something we should uplift in RC?

Comment 8

[Pascal Chevrel (relman team) -> :pascalc]

The volume of crashes on nightly seems unchanged after the patch so it is not clear that the issue in beta/release would be fixed by an uplift. Wontfix for 89 as we build our Release Candidate today.