bugzilla.mozilla.org has resumed normal operation. Attachments prior to 2014 will be unavailable for a few days. This is tracked in Bug 1475801.
Please report any other irregularities here.

Report OOM to stderr in JS_MORE_DETERMINISTIC builds

RESOLVED FIXED in mozilla28

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {testcase})

Trunk
mozilla28
x86
Linux
testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
try {
    (function() {
        evalcx("\
            function f(){\
                return (\
                    ArrayBuffer(\
                        Math.imul(1635, -19798717)\
                    )\
                )\
            }", this
        )
    })()
    x = Map
    x.valueOf = f
    var r
    - x;
    x | 4
    print("FOO")
} catch (e) {}

when run with --fuzzing-safe, sometimes shows "FOO" in stdout, sometimes doesn't (nothing appears in stdout). (This happens without the flag as well) This inconsistency seems to trip up differential testing.

Tested on a 32-bit js opt more-deterministic shell on m-c changeset 16949049f03d with --fuzzing-safe.

Jan, is this a bug?

My configure flags are:

sh ./configure --target=i686-pc-linux --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --disable-threadsafe
Flags: needinfo?(jdemooij)
(Assignee)

Comment 1

5 years ago
This looks like an OOM: we try to allocate a huge ArrayBuffer and I think this will sometimes fail. On OS X, I get malloc failures on stderr.

Can you replace

 } catch (e) {}

with

 } catch (e) { print(e); }

And see if it prints an "out of memory" message?
Flags: needinfo?(jdemooij) → needinfo?(gary)
(Reporter)

Comment 2

5 years ago
Yes, that's right.

$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
FOO
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
FOO
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
FOO
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory
$ ./js-opt-32-dm-linux-581d180a37f3 937550.js
out of memory

Any way to fix/prevent this?
Flags: needinfo?(gary) → needinfo?(jdemooij)
(Assignee)

Comment 3

5 years ago
We could print a message on stderr when we report an OOM, like we do with over-recursion (right?). Would that work for you?
Flags: needinfo?(jdemooij) → needinfo?(gary)
(Reporter)

Comment 4

5 years ago
Yes, that should. You might want to set this only for more-deterministic builds, since there's where we do all the differential testing.
Flags: needinfo?(gary) → needinfo?(jdemooij)
(Assignee)

Comment 5

5 years ago
Created attachment 831050 [details] [diff] [review]
Patch

Have js_ReportOutOfMemory print to stderr in more-deterministic builds, just like js_ReportOverRecursed.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #831050 - Flags: review?(jorendorff)
Flags: needinfo?(jdemooij)

Updated

5 years ago
Summary: Differential Testing: Different output message involving Math.imul → Report OOM to stderr in JS_MORE_DETERMINISTIC builds
Comment on attachment 831050 [details] [diff] [review]
Patch

Review of attachment 831050 [details] [diff] [review]:
-----------------------------------------------------------------

All right.
Attachment #831050 - Flags: review?(jorendorff) → review+
https://hg.mozilla.org/mozilla-central/rev/437f53de3c7f
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in before you can comment on or make changes to this bug.