1703766 - Assertion failure: fallibleScope_ ([OOM] Cannot allocate a new chunk in an infallible scope.), at ds/LifoAlloc.cpp:173

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following crash appeared on mozilla-central revision 20210407-b740f950e497 (debug build, run with --fuzzing-safe --differential-testing --wasm-compiler=baseline+optimizing --test-wasm-await-tier2 --no-sse3 --ion-pruning=on --ion-extra-checks --ion-warmup-threshold=100 --ion-edgecase-analysis=off --ion-gvn=off --fast-warmup --more-compartments --gc-zeal=18,386 --baseline-warmup-threshold=0 --no-threads).

There is no reproducible testcase for this issue but it happens frequently in fuzzing.

Backtrace:

#0  0x000056066e3f81af in js::LifoAlloc::newChunkWithCapacity(unsigned long, bool) ()
#1  0x000056066e3f83a1 in js::LifoAlloc::getOrCreateChunk(unsigned long) ()
#2  0x000056066e3f877b in js::LifoAlloc::allocImplColdPath(unsigned long) ()
#3  0x000056066e88e1ef in js::jit::TempAllocator::allocateInfallible(unsigned long) ()
#4  0x000056066eb39941 in js::jit::PruneUnusedBranches(js::jit::MIRGenerator*, js::jit::MIRGraph&) ()
#5  0x000056066eb372aa in js::jit::OptimizeMIR(js::jit::MIRGenerator*) ()
#6  0x000056066eb3fb6c in js::jit::CompileBackEnd(js::jit::MIRGenerator*, js::jit::WarpSnapshot*) ()
#7  0x000056066eb41452 in js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) ()
#8  0x000056066eb41fc7 in IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) ()
#9  0x00001f0fea323715 in ?? ()
[...]
#39 0x0000000000000000 in ?? ()

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Christian Holler (:decoder)]

Jan suggested this might be related to the recent branch pruning changes and that we might be able to fix this without a testcase. Iain, can you take a look? Thx!

Comment 3

[Iain Ireland [:iain]]

Attachment: Bug 1703766: Add missing ensureBallast in branch pruning r=jandem

Comment 4

[Iain Ireland [:iain]]

Yeah, I can fix this without a testcase. We're missing a call to ensureBallast; the test case probably didn't reduce well because we have a limit on the size of main-thread compilations, and it's hard to make a CFG large enough for pruning to use up all the ballast without exceeding that limit, so we have to race an off-thread compilation against main-thread execution.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/61416db392c7
Add missing ensureBallast in branch pruning r=jandem

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/61416db392c7

Comment 7

[Jason Kratzer [:jkratzer]]

Bugmon Analysis
Unable to reproduce bug using build mozilla-central 20210407212527-b740f950e497. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.