661586 - TM: Assertion failure: !cx->isExceptionPending(), at jscntxtinlines.h:296

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision b9679727505d (run with -j -m -n -a), tested on 64 bit:


function startTest() {
    if (BUGNUMBER) {
        print("BUGNUMBER: " + BUGNUMBER);
    }
}
function TestCase(n, d, e, a)
function writeTestCaseResult(expect, actual, string) {}
var msPerHour = 3600000;
var TZ_PST = -8;
var TZ_ADJUST = -TZ_PST * msPerHour;
addNewTestCase(new Date((new Date(0)).toUTCString()), []);
function addNewTestCase(DateCase, DateString, ResultArray) {
    new TestCase(ResultArray[startTest.toString(TZ_ADJUST + 1)], DateCase.getFullYear() );
}

Comment 1

[Brian Hackett [Laid off!]]

TM bug, we happen to OOM within SprintEnsureBuffer (we repeatedly try to make strings with 28 million spaces in them, due to the indent argument passed to toString) and that OOM is dropped by a caller to js_printf.  js_printf is fallible but none of its callers check for failure.

Comment 2

[Christian Holler (:decoder)]

@bhackett: I cannot reproduce this anymore. From the bug description, is it possible that this is the same issue as in bug 621988? I saw the patch there also checks js_printf failing. The patch from that bug did not land afaik but another refactoring seems to have fixed that bug.

Comment 3

[Brian Hackett [Laid off!]]

AFAIK this hasn't been fixed.  js_printf still returns an error code, and no one checks it.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 8d85de779506).