Closed
Bug 756612
Opened 12 years ago
Closed 12 years ago
IonMonkey: OOM Testing: Crash [@ js::ion::CodeGeneratorX86Shared::visitOutOfLineBailout]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: dvander)
References
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(2 files)
4.82 KB,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
3.72 KB,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
The following command crashes on ionmonkey revision 8c54899dae82 (dbg build): js -e 'const libdir = "js/src/jit-test/lib/";' -A 9445 -f js/src/jit-test/tests/debug/Object-parameterNames.js
Assignee | ||
Comment 1•12 years ago
|
||
IonMonkey relies on infallible allocations for small objects, and we ensure this with a ballast that has remained unimplemented. This patch implements it with some LifoAlloc trickery.
Comment 2•12 years ago
|
||
Comment on attachment 625303 [details] [diff] [review] fix Review of attachment 625303 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ds/LifoAlloc.h @@ +241,5 @@ > > + // Ensures that enough space exists to satisfy N bytes worth of > + // allocation requests, not necessarily contiguous. > + JS_ALWAYS_INLINE > + bool ensureUnused(size_t n) { iiuc, this isn't strictly true for the fast-path algorithm below since, if a chunk reports k bytes of unused space and an allocation is made for >k bytes, that chunk's unused space can't be used. However, this doesn't really matter for the purpose of the ballast since n only has to be approximate. So my only request is to rename this to ensureUnusedApproximate and update the comment accordingly.
Attachment #625303 -
Flags: review?(luke) → review+
Assignee | ||
Comment 3•12 years ago
|
||
Quick follow-up patch to make it so OOM testing can't inject OOMs into our infallible allocations.
Attachment #625314 -
Flags: review?(luke)
Updated•12 years ago
|
Attachment #625314 -
Flags: review?(luke) → review+
Assignee | ||
Comment 4•12 years ago
|
||
Whoa, fast reviews! http://hg.mozilla.org/projects/ionmonkey/rev/88ea2e529609 Christian, would you mind having the OOM tester re-test all the bugs it filed today? I ran through them and could not reproduce them after implementing the ballast.
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•