Last Comment Bug 727476 - JS OOM Testing: Assertion failure: compartment()->activeInference, at js/src/jsinfer.cpp:2161 or Crash [@ JSString::isAtom]
: JS OOM Testing: Assertion failure: compartment()->activeInference, at js/src/...
: assertion, crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
-- critical (vote)
: mozilla14
Assigned To: general
: Jason Orendorff [:jorendorff]
: 734972 (view as bug list)
Depends on:
  Show dependency treegraph
Reported: 2012-02-15 09:00 PST by Christian Holler (:decoder)
Modified: 2012-04-13 15:07 PDT (History)
7 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (490 bytes, patch)
2012-04-10 07:15 PDT, Brian Hackett (:bhackett)
luke: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-02-15 09:00:32 PST
The following command crashes/asserts on mozilla-central revision d45c7d7b0079:

js -m -n -a -A 501026 -f js/src/tests/shell.js -f js/src/tests/e4x/shell.js -f js/src/tests/e4x/GC/shell.js -f js/src/tests/e4x/GC/regress-280844-2.js

Passing through the assertions yields this crash:

Program received signal SIGABRT, Aborted.
out of memory
Assertion failure: str, at ../../jsval.h:702

Program received signal SIGABRT, Aborted.

Program received signal SIGSEGV, Segmentation fault.
0x0000000000442e04 in JSString::isAtom (this=0x0) at /home/decoder/LangFuzz/mozilla-central/js/src/vm/String.h:381
381             bool atomized = (d.lengthAndFlags & ATOM_MASK) == ATOM_FLAGS;
(gdb) bt 4
#0  0x0000000000442e04 in JSString::isAtom (this=0x0) at /home/decoder/LangFuzz/mozilla-central/js/src/vm/String.h:381
#1  0x0000000000444db4 in js::CompartmentChecker::check (this=0x7fffffffce30, str=0x0) at ../jscntxtinlines.h:181
#2  0x0000000000444e4a in js::CompartmentChecker::check (this=0x7fffffffce30, v=...) at ../jscntxtinlines.h:189
#3  0x0000000000447f77 in js::assertSameCompartment<JS::Value> (cx=0xb5eae0, t1=...) at ../jscntxtinlines.h:251
Comment 1 User image Bob Clary [:bc:] 2012-02-23 13:19:23 PST
Note this assertion is common on oom/low memory conditions with image suck bugs.
Comment 2 User image Brian Hackett (:bhackett) 2012-04-10 07:15:23 PDT
Created attachment 613588 [details] [diff] [review]

Bogus assert.
Comment 3 User image Brian Hackett (:bhackett) 2012-04-10 09:10:03 PDT
*** Bug 734972 has been marked as a duplicate of this bug. ***
Comment 4 User image Brian Hackett (:bhackett) 2012-04-10 12:57:20 PDT
Comment 5 User image Matt Brubeck (:mbrubeck) 2012-04-11 09:16:54 PDT
Comment 6 User image Bob Clary [:bc:] 2012-04-13 15:07:14 PDT
Matt, I still see this assertion during low/oom conditions due to image-suck at Is that assertion bogus as well?

Note You need to log in before you can comment on or make changes to this bug.