1823212 - Assertion failure: isThrowingOutOfMemory(), at vm/JSContext.cpp:698

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[lukas.bernhard]

Steps to reproduce:

On git commit 5b59e4aeae621e45feacc7e9e4125a8ea7bebb9d the attach sample asserts in the js-shell when invoked as obj-x86_64-pc-linux-gnu/dist/bin/js --baseline-warmup-threshold=10 --fuzzing-safe crash.js.
The exception status is JS::ExceptionStatus::OverRecursed instead of OOM.
Bisecting did not identify a recent regressor.

with (this.newGlobal(this, this)) {
    const v2 = `
        const v4 = ("p").__proto__;
        function f5(a6, a7) {
            try {
                a6.search(v4);
            } catch(e9) {
                ("h6U")["p"](...arguments);
            }
            return a7;
        }
        v4[Symbol.toPrimitive] = f5;
        v4.trimEnd();
    `;
    eval(v2);
}

#0  0x0000555557901100 in JSContext::recoverFromOutOfMemory (this=0x7ffff7433500)
    at js/src/vm/JSContext.cpp:735
#1  0x0000555558add673 in js::jit::OptimizeSpreadCallIRGenerator::tryAttachArguments (this=0x7fffffdff278)
    at js/src/jit/CacheIR.cpp:5535
#2  0x0000555558adce17 in js::jit::OptimizeSpreadCallIRGenerator::tryAttachStub (this=0x7fffffdff278)
    at js/src/jit/CacheIR.cpp:5384
#3  0x00005555586b30a3 in js::jit::TryAttachStub<js::jit::OptimizeSpreadCallIRGenerator, JS::Handle<JS::Value>&> (
    name=0x555555b5738d "OptimizeSpreadCall", cx=0x7ffff7433500, frame=0x7fffffdff568, stub=0x7ffff4cdcfb8, args=...)
    at js/src/jit/BaselineIC.cpp:440
#4  0x00005555586b2dc1 in js::jit::DoOptimizeSpreadCallFallback (cx=0x7ffff7433500, frame=0x7fffffdff568, 
    stub=0x7ffff4cdcfb8, value=..., res=...) at js/src/jit/BaselineIC.cpp:1888
#5  0x00002c8b93ed50b3 in ?? ()
#6  0x00002033ce680c38 in ?? ()
#7  0x00007fffffdff500 in ?? ()
#8  0xfff9800000000000 in ?? ()
#9  0x0000555559975290 in js::jit::tailCallVMFunctions ()

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

Not sure what policy we'd want to adopt on over-recursion here.

Comment 2

[Iain Ireland [:iain]]

This is just an overspecific assertion. It's effectively the same as bug 1813387, and the same fix should work.

Comment 3

[Iain Ireland [:iain]]

Attachment: Bug 1823212: Fix error handling in tryAttachArguments r=mgaudet!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/78da6a675a0a
Fix error handling in tryAttachArguments r=mgaudet

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/78da6a675a0a