The default bug view has changed. See this FAQ.

Assertion failure: ok, at ../vm/GlobalObject.h:415 with OOM and ParallelArray

RESOLVED FIXED in mozilla26

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: till)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
mozilla26
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision c7cc85e13f7a (run with --fuzzing-safe --ion-eager):


oomAfterAllocations(51);
var p = new ParallelArray([1,2,3,4]);
(Reporter)

Comment 1

4 years ago
Created attachment 802268 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 2

4 years ago
I'm seeing this assertion very frequently, but stacks vary. I'll try to figure out if there are more tests. At least one stack contains Intl instead of ParallelArray, others contain neither one nor the other.
Blocks: 912928, 872823
Summary: Assertion failure: ok, at ../vm/GlobalObject.h:415 with OOM → Assertion failure: ok, at ../vm/GlobalObject.h:415 with OOM and ParallelArray
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 3

4 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/23dda916c3d0
user:        Shu-yu Guo
date:        Sat May 11 22:39:46 2013 -0700
summary:     Bug 860965 - Part 1: Copy 1D ParallelArray operations to Array. (r=luke,nmatsakis)

This iteration took 327.077 seconds to run.
The assert is that a JS_DefineProperty in GlobalObject::getSelfHostedValue or whichever never fails.  Why we're asserting this, when the method has a perfectly reasonable bool failure return that could be propagated, I'm not entirely sure.
(Assignee)

Comment 5

4 years ago
The best explanation I can come up with is luke's request to add an assert that *getting* a self-hosted function succeeded: https://bugzilla.mozilla.org/show_bug.cgi?id=462300#c56

This then morphed (through emergent behavior nobody's responsible for) into the current weird construct. Will attach a patch to cut back the uncontrolled growth.
Thanks for taking this OOM bug, Till!
Assignee: general → till
(Assignee)

Comment 7

4 years ago
Created attachment 802967 [details] [diff] [review]
Remove non-required, crashing-on-oom assert in GlobalObject::getIntrinsicValue.

Just removing this should be fine and all that's needed
Attachment #802967 - Flags: review?(terrence)
Comment on attachment 802967 [details] [diff] [review]
Remove non-required, crashing-on-oom assert in GlobalObject::getIntrinsicValue.

Review of attachment 802967 [details] [diff] [review]:
-----------------------------------------------------------------

Yup. r=me
Attachment #802967 - Flags: review?(terrence) → review+
(Assignee)

Comment 9

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/38bcba92aa14

Thanks for the quick review.
https://hg.mozilla.org/mozilla-central/rev/38bcba92aa14
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
You need to log in before you can comment on or make changes to this bug.