482016 - TM: jited code does not set JSRuntime.gcPoke

Status: RESOLVED DUPLICATE of bug 482038

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

Currently the jited code  does not set JSRuntime.gcPoke when it overwrites GC things. That prevents js_NewGCThing from triggering the GC when the allocator hits max-malloc-bytes heuristic. The following example the problem with JS shell:

@watson~> cat ~/s/x1.js
function f()
{
    var s = Array(5<<20).join(".");
    for (var i = 0; i != 500; ++i) {
        var tmp = s.substring(1);
    }
}

f();
print('OK');
@watson~> ~/build/js32.tm.dbg/js ~/s/x1.js
OK
@watson~> ~/build/js32.tm.dbg/js -j ~/s/x1.js
Assertion failure: cx->bailExit, at /home/igor/m/tm/js/src/jstracer.cpp:4709
Trace/breakpoint trap


Note that the assert here is due to the bug 482015 and happens during OOM reporting, which should not happen as with jit disabled the allocator properly triggers the GC.

Comment 1

[Igor Bukanov]

The bug 482038 addresses this bug as well via removal of gcPoke checks from the allocator.