507675 - TM: Out of memory error with -j for microbenchmark

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gregor Wagner]

Following microbenchmark generates an out of memory error with JIT enabled.

var t0 = new Date;

for(var i=0;i<10000000;i++)
    new Date;

print(new Date - t0);



host-6-16:src mozilla$ ./OPT.OBJ/js -j ./date.js 
./date.js:4: out of memory
./date.js:4: out of memory
./date.js:4: out of memory
./date.js:4: out of memory
./date.js:4: out of memory
./date.js:4: out of memory
4164
host-6-16:src mozilla$ ./OPT.OBJ/js ./date.js 
6741

Comment 1

[Brendan Eich [:brendan]]

Is this a regression from the fix for bug 505612 ? If so, please note that this bug blocks that bug.

/be

Comment 2

[Andreas Gal :gal]

Seems to work in the browser. Gregor, can you confirm? (try javascript: for(var i=0;i<10000000;i++) new Date; in the url bar).

Comment 3

[Jeff Walden [:Waldo]]

Breakpoint 2, js_ReportOutOfMemory (cx=0x2009800) at ../jscntxt.cpp:1297
1297        if (JS_ON_TRACE(cx) && !cx->bailExit)
(gdb) bt 5
#0  js_ReportOutOfMemory (cx=0x2009800) at ../jscntxt.cpp:1297
#1  0x0002a542 in RefillDoubleFreeList (cx=0x2009800) at ../jsgc.cpp:2087
#2  0x0002a916 in js_NewDoubleInRootedValue (cx=0x2009800, d=0, vp=0xbfffc608) at ../jsgc.cpp:2193
#3  0x0002a993 in js_NewWeaklyRootedDouble (cx=0x2009800, d=0) at ../jsgc.cpp:2213
#4  0x000b6ea3 in date_constructor (cx=0x2009800, obj=0x5c206a0) at ../jsdate.cpp:2099
(More stack frames follow...)
(gdb) bt 8
#0  js_ReportOutOfMemory (cx=0x2009800) at ../jscntxt.cpp:1297
#1  0x0002a542 in RefillDoubleFreeList (cx=0x2009800) at ../jsgc.cpp:2087
#2  0x0002a916 in js_NewDoubleInRootedValue (cx=0x2009800, d=0, vp=0xbfffc608) at ../jsgc.cpp:2193
#3  0x0002a993 in js_NewWeaklyRootedDouble (cx=0x2009800, d=0) at ../jsgc.cpp:2213
#4  0x000b6ea3 in date_constructor (cx=0x2009800, obj=0x5c206a0) at ../jsdate.cpp:2099
#5  0x000b6f3c in js_Date (cx=0x2009800, obj=0x5c206a0, argc=0, argv=0xbfffc710, rval=0xbfffc72c) at ../jsdate.cpp:2121
#6  0x009aef68 in ?? ()
#7  0xbfffed78 in ?? ()
(More stack frames follow...)
(gdb) n
1302        JSErrorReporter onError = cx->errorReporter;
(gdb) s
1306            js_GetLocalizedErrorMessage(cx, NULL, NULL, JSMSG_OUT_OF_MEMORY);
(gdb) p cx->bailExit
$1 = (VMSideExit *) 0x9ad2cc
(gdb) p cx->runtime->threadData.traceMonitor.tracecx
$2 = (JSContext *) 0x2009800

So we're not returning early in js_ReportOutOfMemory via the tracing condition:

1294      * If we are in a builtin called directly from trace, don't report an
1295      * error. We will retry in the interpreter instead.
1296      */
1297     if (JS_ON_TRACE(cx) && !cx->bailExit)
1298         return;

Comment 4

[Gregor Wagner]

Yeah it works in the browser.

(In reply to comment #2)
> Seems to work in the browser. Gregor, can you confirm? (try javascript: for(var
> i=0;i<10000000;i++) new Date; in the url bar).

Comment 5

[Andreas Gal :gal]

The browser calls MaybeGC. That avoids it. We still have to fix the stack trace waldo posted though to make sure last ditch gets it.

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3fb63f9f32ec

Comment 7

[Robert Sayre]

oops, wrong bug number in the checkin comment for that changeset

Comment 8

[Ryan VanderMeulen [:RyanVM]]

No OOM with Interp, TM, JM, or JM+TI with a current JS shell.