912328 - Differential Testing: Different output message involving gcPreserveCode

Status: RESOLVED DUPLICATE of bug 932982

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    a = [Boolean, Boolean]
    for (m = 0; m < 9; m++) {
        c = m
    }
} catch (e) {}
try {
    b = a.join()
    gcPreserveCode()
    for (n = c; n < 22; ++n) {
        x = n
    }
    x <<= x
    for (v of b) {
        y = Uint16Array(x)
    }
    y = []
    print("foo")
} catch (e) {}

prints nothing on js opt shell on m-c changeset e3785e299ab6 without any CLI arguments, when the testcase is passed in as a CLI argument. However it prints "foo" with --no-baseline --no-ion --no-ti.

My configure flags are:

--enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-threadsafe <more NSPR compilation flags>

Comment 1

[Jan de Mooij [:jandem]]

Brian, is it expected that the testcase below works fine without TI but OOMs with TI enabled? This happens also with the JITs disabled. It looks like we're not GC'ing the old arrays or something.

It would be nice if we could fix this, the code doesn't look very unreasonable.

function f() {
    gcPreserveCode();

    for (var j=0; j<100; j++)
	y = Uint16Array(22 * 1000 * 1000);
}
f();

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, re-ping please?

Comment 3

[Brian Hackett [Laid off!]]

I get the same output now with either set of CLI flags.  If we were OOM'ing before then this was fixed by bug 932982, as we give singleton types to all large typed arrays and before bug 932982 we marked these whenever doing a GC which preserved jitcode.