756614 - IonMonkey: OOM Testing: Assertion failure: !used(), at js/src/ion/shared/Assembler-shared.h:256

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following command asserts on ionmonkey revision 8c54899dae82 (dbg build):

js  -e 'const libdir = "js/src/jit-test/lib/";' -A 9439 -f js/src/jit-test/tests/debug/Object-parameterNames.js

Comment 2

[Christian Holler (:decoder)]

I was wrong, the assertion is still there on OOM, just needs another test (rev 88ea2e529609):

js -e 'const libdir = "js/src/jit-test/lib/";' -A 7315 -f js/src/jit-test/tests/pic/length_string_object.js

Comment 3

[Jan de Mooij [:jandem]]

This one is annoying: if we return early due to an OOM, not all labels are bound and the Label destructor asserts.

dvander, should we remove the assert? It'd be unfortunate but I can't think of another way to fix this bug.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

The assert is valuable, more valuable than the test which is not a real bug. I'm wont to consider it WONTFIX or find a hacky, debug only way to make it not appear when OOM testin.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Patch

OK, here's the hack to disable the assert when we triggered an OOM.

Comment 6

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/407632130d1b

Comment 7

[Christian Holler (:decoder)]

I'm afraid this fix is not sufficient. I'm hitting this assert also in LangFuzz (without -A), due to OOM. We probably need to recognize the OOM condition itself and not only the artificial condition caused by OOM testing with -A.

Comment 8

[Jan de Mooij [:jandem]]

decoder please file a new bug if you're still seeing this, but I think this was fixed a while ago.