937550 - Report OOM to stderr in JS_MORE_DETERMINISTIC builds

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    (function() {
        evalcx("\
            function f(){\
                return (\
                    ArrayBuffer(\
                        Math.imul(1635, -19798717)\
                    )\
                )\
            }", this
        )
    })()
    x = Map
    x.valueOf = f
    var r
    - x;
    x | 4
    print("FOO")
} catch (e) {}

when run with --fuzzing-safe, sometimes shows "FOO" in stdout, sometimes doesn't (nothing appears in stdout). (This happens without the flag as well) This inconsistency seems to trip up differential testing.

Tested on a 32-bit js opt more-deterministic shell on m-c changeset 16949049f03d with --fuzzing-safe.

Jan, is this a bug?

My configure flags are:

sh ./configure --target=i686-pc-linux --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --disable-threadsafe

Comment 1

[Jan de Mooij [:jandem]]

This looks like an OOM: we try to allocate a huge ArrayBuffer and I think this will sometimes fail. On OS X, I get malloc failures on stderr.

Can you replace

 } catch (e) {}

with

 } catch (e) { print(e); }

And see if it prints an "out of memory" message?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yes, that's right.

$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
FOO
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
FOO
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
FOO
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory

Any way to fix/prevent this?

Comment 3

[Jan de Mooij [:jandem]]

We could print a message on stderr when we report an OOM, like we do with over-recursion (right?). Would that work for you?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yes, that should. You might want to set this only for more-deterministic builds, since there's where we do all the differential testing.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Patch

Have js_ReportOutOfMemory print to stderr in more-deterministic builds, just like js_ReportOverRecursed.

Comment 6

[Jason Orendorff [:jorendorff]]

Comment on attachment 831050 [details] [diff] [review]
Patch

Review of attachment 831050 [details] [diff] [review]:
-----------------------------------------------------------------

All right.

Comment 7

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/437f53de3c7f

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/437f53de3c7f