Assertion failure: !cx->isExceptionPending(), at jit/IonBuilder.cpp:3779 with OOM

RESOLVED FIXED in mozilla27

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
mozilla27
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox26 affected)

Details

(Whiteboard: [jsbugmon:])

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision ab4ccf3d6b60 (run with --fuzzing-safe --ion-eager):


gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
function A(a) { this.a = a; }
function B(b) { this.b = b; }
function C(c) { this.c = c; }
function makeArray(n) {
    var classes = [A, B, C];
    var arr = [];
    for (var i = 0; i < n; i++) {
        arr.push(new classes[i % 3](i % 3));
    }
}
var arr = makeArray(30000);
(Reporter)

Comment 1

4 years ago
Created attachment 806583 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 2

4 years ago
Just hit this OOM error again and since the other isExceptionPending assertion has been fixed, this must be something new.
Blocks: 912928, 872823
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 3

4 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/67e44e98555c
user:        Hannes Verschore
date:        Fri Jan 04 17:11:32 2013 +0100
summary:     Bug 825705: Creating this on caller-side shouldn't query prototype for unknown objects, r=jandem

This iteration took 124.057 seconds to run.
(Reporter)

Comment 4

4 years ago
Hannes, can you look at this one?
Flags: needinfo?(hv1989)
Kannan, can you have a look? I think we have an pending exception in the parent before inlining. At least I see no reason why that wouldn't be possible. So this assert needs to get deleted, maybe handled like the check you introduced after inlining?
Flags: needinfo?(hv1989) → needinfo?(kvijayan)
(In reply to Christian Holler (:decoder) from comment #4)
> Hannes, can you look at this one?

Sorry about the delay in checking this, but was on Holiday...
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Comment 7

4 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision ddd03c32fab1).
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Is it normal it takes so long to bisect the range to find the fix?
Flags: needinfo?(choller)
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 9

4 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f613d7363bd2
user:        Brian Hackett
date:        Mon Oct 14 12:13:41 2013 -0600
summary:     Bug 924611 - Don't create lazy type objects and type properties in IonBuilder, r=jandem.

This iteration took 417.636 seconds to run.
Flags: needinfo?(choller) → needinfo?(hv1989)
Brian: do you think this could have solved this issue? I don't see a change that could be linked with the introduction of the bug. Or do you think this has only hidden the problem?
Flags: needinfo?(kvijayan)
Flags: needinfo?(hv1989)
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 11

4 years ago
Yeah, since IonBuilder doesn't use a cx anymore except for limited cases in the definite properties analysis it doesn't create many exceptions anymore.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → FIXED
(Reporter)

Updated

4 years ago
status-firefox26: --- → affected
Assignee: general → bhackett1024
Depends on: 924611
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.