734972 - JS OOM Testing: Assertion failure: compartment()->activeInference, at js/src/jsinfer.cpp:2152

Status: RESOLVED DUPLICATE of bug 727476

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following command crashes/aborts on mozilla-central revision c6f26a8dcd08:

js -m -n -a -A 10617 -f js/src/jit-test/tests/basic/bug732087.js


Could be related to bug 727476 but here is no crash afterwards.

Here's the full backtrace of the failed allocation (as outputted when compiling with --enable-oom-backtrace and filtered through addr2line):

#0 js/src/debug64-trunk/js(+0x685215) (PrintBacktrace at /home/decoder/LangFuzz/mozilla-central/js/src/debug64-trunk/./dist/include/js/Utility.h:130)
#1 js/src/debug64-trunk/js(+0x6852f7) (js_malloc at /home/decoder/LangFuzz/mozilla-central/js/src/debug64-trunk/./dist/include/js/Utility.h:172)
#2 js/src/debug64-trunk/js(+0x685459) (js::detail::BumpChunk::new_(unsigned long) at /home/decoder/LangFuzz/mozilla-central/js/src/ds/LifoAlloc.cpp:54)
#3 js/src/debug64-trunk/js(+0x685853) (js::LifoAlloc::getOrCreateChunk(unsigned long) at /home/decoder/LangFuzz/mozilla-central/js/src/ds/LifoAlloc.cpp:163)
#4 js/src/debug64-trunk/js(+0x4059c8) (js::LifoAlloc::alloc(unsigned long) at /home/decoder/LangFuzz/mozilla-central/js/src/debug64-trunk/shell/../../ds/LifoAlloc.h:230)
#5 js/src/debug64-trunk/js(+0x4ef1d4) (js::types::Property* js::LifoAlloc::new_<js::types::Property, js::types::Property>(js::types::Property) at /home/decoder/LangFuzz/mozilla-central/js/src/ds/LifoAlloc.h:320)
#6 js/src/debug64-trunk/js(+0x4ea88d) (js::types::TypeObject::sweep(JSContext*) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinfer.cpp:6036)
#7 js/src/debug64-trunk/js(+0x4eaa52) (SweepTypeObjectOp::operator()(js::gc::Cell*) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinfer.cpp:6070)
#8 js/src/debug64-trunk/js(+0x4ef378) (void js::gc::ForEachArenaAndCell<void (*)(js::gc::Arena*), SweepTypeObjectOp>(JSCompartment*, js::gc::AllocKind, void (*)(js::gc::Arena*), SweepTypeObjectOp) at /home/decoder/LangFuzz/mozilla-central/js/src/debug64-trunk/../jsgcinlines.h:236)
#9 js/src/debug64-trunk/js(+0x4eaa96) (SweepTypeObjects(JSContext*, JSCompartment*) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinfer.cpp:6078)
#10 js/src/debug64-trunk/js(+0x4eaadb) (js::types::TypeCompartment::sweep(JSContext*) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinfer.cpp:6092)
#11 js/src/debug64-trunk/js(+0x47df23) (JSCompartment::sweep(JSContext*, bool) at /home/decoder/LangFuzz/mozilla-central/js/src/jscompartment.cpp:559)
#12 js/src/debug64-trunk/js(+0x4b728c) (SweepPhase at /home/decoder/LangFuzz/mozilla-central/js/src/jsgc.cpp:3193)
#13 js/src/debug64-trunk/js(+0x4b79d3) (MarkAndSweep at /home/decoder/LangFuzz/mozilla-central/js/src/jsgc.cpp:3288)
#14 js/src/debug64-trunk/js(+0x4b88aa) (GCCycle at /home/decoder/LangFuzz/mozilla-central/js/src/jsgc.cpp:3634)
#15 js/src/debug64-trunk/js(+0x4b8bb1) (Collect at /home/decoder/LangFuzz/mozilla-central/js/src/jsgc.cpp:3714)
#16 js/src/debug64-trunk/js(+0x4b8cd1) (js::GC(JSContext*, JSCompartment*, js::JSGCInvocationKind, js::gcreason::Reason) at /home/decoder/LangFuzz/mozilla-central/js/src/jsgc.cpp:3737)
#17 js/src/debug64-trunk/js(+0x4b389d) (js::gc::RunLastDitchGC(JSContext*, js::gcreason::Reason) at /home/decoder/LangFuzz/mozilla-central/js/src/jsgc.cpp:1697)
#18 js/src/debug64-trunk/js(+0x4b99a2) (js::gc::RunDebugGC(JSContext*) at /home/decoder/LangFuzz/mozilla-central/js/src/jsgc.cpp:3961)
#19 js/src/debug64-trunk/js(+0x45dd0e) (JSObject* js::gc::NewGCThing<JSObject>(JSContext*, js::gc::AllocKind, unsigned long) at /home/decoder/LangFuzz/mozilla-central/js/src/debug64-trunk/../jsgcinlines.h:418)
#20 js/src/debug64-trunk/js(+0x44f054) (js_NewGCObject(JSContext*, js::gc::AllocKind) at /home/decoder/LangFuzz/mozilla-central/js/src/debug64-trunk/../jsgcinlines.h:462)
#21 js/src/debug64-trunk/js(+0x451563) (JSObject::createDenseArray(JSContext*, js::gc::AllocKind, js::Handle<js::Shape*>, js::Handle<js::types::TypeObject*>, unsigned int) at /home/decoder/LangFuzz/mozilla-central/js/src/debug64-trunk/../jsobjinlines.h:1078)
#22 js/src/debug64-trunk/js(+0x46223e) (JSObject* js::NewArray<true>(JSContext*, unsigned int, JSObject*) at /home/decoder/LangFuzz/mozilla-central/js/src/jsarray.cpp:3805)
#23 js/src/debug64-trunk/js(+0x45d7ab) (js::NewDenseCopiedArray(JSContext*, unsigned int, JS::Value const*, JSObject*) at /home/decoder/LangFuzz/mozilla-central/js/src/jsarray.cpp:3859)
#24 js/src/debug64-trunk/js(+0x4ffd07) (NoSuchMethod at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:414)
#25 js/src/debug64-trunk/js(+0x500176) (js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:500)
#26 js/src/debug64-trunk/js(+0x50c183) (js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:2710)
#27 js/src/debug64-trunk/js(+0x69e1e3) (js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool) at /home/decoder/LangFuzz/mozilla-central/js/src/methodjit/MethodJIT.cpp:1079)