Closed Bug 756612 Opened 9 years ago Closed 9 years ago

IonMonkey: OOM Testing: Crash [@ js::ion::CodeGeneratorX86Shared::visitOutOfLineBailout]

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

The following command crashes on ionmonkey revision 8c54899dae82 (dbg build):

js  -e 'const libdir = "js/src/jit-test/lib/";' -A 9445 -f js/src/jit-test/tests/debug/Object-parameterNames.js
Attached patch fixSplinter Review
IonMonkey relies on infallible allocations for small objects, and we ensure this with a ballast that has remained unimplemented. This patch implements it with some LifoAlloc trickery.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #625303 - Flags: review?(luke)
Comment on attachment 625303 [details] [diff] [review]
fix

Review of attachment 625303 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ds/LifoAlloc.h
@@ +241,5 @@
>  
> +    // Ensures that enough space exists to satisfy N bytes worth of
> +    // allocation requests, not necessarily contiguous.
> +    JS_ALWAYS_INLINE
> +    bool ensureUnused(size_t n) {

iiuc, this isn't strictly true for the fast-path algorithm below since, if a chunk reports k bytes of unused space and an allocation is made for >k bytes, that chunk's unused space can't be used.  However, this doesn't really matter for the purpose of the ballast since n only has to be approximate.  So my only request is to rename this to ensureUnusedApproximate and update the comment accordingly.
Attachment #625303 - Flags: review?(luke) → review+
Attached patch follow-upSplinter Review
Quick follow-up patch to make it so OOM testing can't inject OOMs into our infallible allocations.
Attachment #625314 - Flags: review?(luke)
Attachment #625314 - Flags: review?(luke) → review+
Whoa, fast reviews! http://hg.mozilla.org/projects/ionmonkey/rev/88ea2e529609

Christian, would you mind having the OOM tester re-test all the bugs it filed today? I ran through them and could not reproduce them after implementing the ballast.
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Duplicate of this bug: 756605
Duplicate of this bug: 756609
Duplicate of this bug: 756611
Duplicate of this bug: 756613
Duplicate of this bug: 756614
Duplicate of this bug: 756617
Duplicate of this bug: 756621
Duplicate of this bug: 756622
Duplicate of this bug: 756623
Duplicate of this bug: 756624
Duplicate of this bug: 756626
Duplicate of this bug: 756627
You need to log in before you can comment on or make changes to this bug.