1878098 - Assertion failure: self.get(), at builtin/TestingFunctions.cpp:5274

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

x = [];
x.keepFailing = [];
oomTest(function () {
  y = { z: [] };
  makeSerializable().log;
}, x);

(gdb) bt
#0  CustomSerializableObject::ActivityLog::getThreadLog ()
    at /home/gen32gx500/trees/mozilla-central/js/src/builtin/TestingFunctions.cpp:5274
#1  0x000055555778fcc1 in CustomSerializableObject::getLog_impl (
    cx=cx@entry=0x7ffff662e100, args=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/builtin/TestingFunctions.cpp:5362
#2  0x000055555778f938 in JS::CallNonGenericMethod<&CustomSerializableObject::is, &CustomSerializableObject::getLog_impl> (cx=0x7ffff662e100, args=...)
    at /home/gen32gx500/shell-cache/js-dbg-64-linux-x86_64-366005a91eda/objdir-js/dist/include/js/CallNonGenericMethod.h:103
#3  CustomSerializableObject::getLog (cx=cx@entry=0x7ffff662e100, 
    argc=<optimized out>, vp=<optimized out>)
    at /home/gen32gx500/trees/mozilla-central/js/src/builtin/TestingFunctions.cpp:5355
#4  0x00005555571c5125 in CallJSNative (cx=cx@entry=0x7ffff662e100, 
    native=native@entry=0x55555778f850 <CustomSerializableObject::getLog(JSContext*, unsigned int, JS::Value*)>, reason=reason@entry=js::CallReason::Getter, args=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/Interpreter.cpp:480
#5  0x000055555719c19b in js::InternalCallOrConstruct (cx=0x7ffff662e100, args=..., 
    construct=construct@entry=js::NO_CONSTRUCT, reason=js::CallReason::Getter)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/Interpreter.cpp:574
#6  0x000055555719d10d in InternalCall (cx=0x7ffff7e37700 <_IO_stdfile_2_lock>, 
    cx@entry=0x7ffff662e100, args=..., reason=1488306768, 
    reason@entry=js::CallReason::Getter)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/Interpreter.cpp:641
#7  0x000055555719d32e in js::Call (cx=cx@entry=0x7ffff662e100, 
    fval=fval@entry=..., thisv=thisv@entry=..., args=..., rval=rval@entry=..., 
    reason=reason@entry=js::CallReason::Getter)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/Interpreter.cpp:673
#8  0x000055555719e744 in js::CallGetter (cx=cx@entry=0x7ffff662e100, 
    thisv=thisv@entry=..., getter=getter@entry=..., rval=rval@entry=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/Interpreter.cpp:795
#9  0x00005555574bbbcb in CallGetter (cx=<optimized out>, obj=..., receiver=..., 
    id=..., prop=..., vp=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/NativeObject.cpp:2150
#10 GetExistingProperty<(js::AllowGC)1> (cx=cx@entry=0x7ffff662e100, 
    receiver=receiver@entry=..., obj=obj@entry=..., id=id@entry=..., prop=..., 
    vp=vp@entry=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/NativeObject.cpp:2178
#11 0x00005555574bc599 in NativeGetPropertyInline<(js::AllowGC)1> (
    cx=0x7ffff662e100, obj=..., receiver=..., id=..., nameLookup=NotNameLookup, 
    vp=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/NativeObject.cpp:2326
#12 0x00005555570ae8db in js::GetProperty (cx=0x7ffff662e100, obj=..., 
    receiver=..., name=<optimized out>, vp=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/ObjectOperations-inl.h:124
#13 0x00005555571c01e8 in js::GetProperty (cx=cx@entry=0x7ffff662e100, 
    v=v@entry=..., name=name@entry=..., vp=vp@entry=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/vm/Interpreter.cpp:4519
#14 0x0000555557d76b34 in js::jit::DoGetPropFallback (cx=0x7ffff662e100, 
    frame=0x7fffffffc048, stub=0x7ffff6448a10, val=..., res=...)
    at /home/gen32gx500/trees/mozilla-central/js/src/jit/BaselineIC.cpp:1283
/snip

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --disable-bootstrap --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 366005a91eda.

Setting s-s to be safe.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/0e22cec33a2f
user:        Steve Fink
date:        Wed May 10 16:51:48 2023 +0000
summary:     Bug 1818576 - Test infrastructure for custom serializable objects r=spidermonkey-reviewers,mgaudet

Steve, is bug 1818576 a likely regressor?

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1818576

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

Not s-s, crash in testing code itself. Likely needs to simply be marked as AutoEnterOOMUnsafeRegion

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1818576

Comment 5

[Steve Fink [:sfink] [:s:]]

Attachment: Bug 1878098 - Properly oom check test serialization log allocation

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/978a40eb07a2
Properly oom check test serialization log allocation r=spidermonkey-reviewers,mgaudet

Comment 7

[Sandor Molnar[:smolnar]]

Backed out for causing spider-monkey failures

Backout link: https://hg.mozilla.org/integration/autoland/rev/05e1180d2aa04a8882ff66dfaeeb0705694f7a61

Push with failures

Failure log -> TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/bug1878098-serialization-log-oom.js | /builds/worker/checkouts/gecko/js/src/jit-test/tests/bug1878098-serialization-log-oom.js:3:1 ReferenceError: oomTest is not defined

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/771144ea376d
Properly oom check test serialization log allocation r=spidermonkey-reviewers,mgaudet

Comment 9

[Cosmin Sabou [:CosminS]]

Backed out for SM failures on bug1878098-serialization-log-oom.js

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=771144ea376d6f54b3052bb250d1077953ec040e&selectedTaskRun=OFyUqofDR5aJfFQF6ig0BQ.0

Failure log: https://treeherder.mozilla.org/logviewer?job_id=447828509&repo=autoland

Backout link: https://hg.mozilla.org/integration/autoland/rev/558067032002ffc8a775205a29adbe2dd686df28

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d07920bed34c
Properly oom check test serialization log allocation r=spidermonkey-reviewers,mgaudet

Comment 11

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/d07920bed34c