948023 - Refactor ReconstructStackDepth to allow handling of OOM condition

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: js-ReconstructStackDepth-oom.patch

Right now, [@ ReconstructStackDepth] returns false both when an OOM occurs and when the *pc is unreachable. The attached patch refactors the function to return false on OOM and pass the reachable/unreachable part back in a second variable. With this patch, some OOM assertions are fixed that LangFuzz keeps hitting.

Comment 1

[Jan de Mooij [:jandem]]

Comment on attachment 8344767 [details] [diff] [review]
js-ReconstructStackDepth-oom.patch

Review of attachment 8344767 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks.

Comment 2

[Christian Holler (:decoder)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/029c51a1a898

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/029c51a1a898

Comment 4

[Chris Peterson [:cpeterson]]

Christian: should this OOM fix be uplifted to Aurora 28?

Comment 5

[Christian Holler (:decoder)]

This isn't a huge refactoring, but it's still more than just adding a null check, so I suggest we just let it ride the trains. No immediate need for this on the branches.

Comment 6

[Christian Holler (:decoder)]

gkw just pointed out that Aurora 28 is going to be used as a foundation for the next B2G version. Since OOM crashes are more of an issue to them than regularly, it might be worth uplifting. I'll fill out the form.

Comment 7

[Christian Holler (:decoder)]

Comment on attachment 8344767 [details] [diff] [review]
js-ReconstructStackDepth-oom.patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): N/A
User impact if declined: Crashes in OOM conditions
Testing completed (on m-c, etc.): A few days on mozilla-central
Risk to taking this patch (and alternatives if risky): Very low, this is just a simple refactoring and adding some return value checks that were previously missing/wrong.
String or IDL/UUID changes made by this patch: None

Comment 8

[Christian Holler (:decoder)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/c6eb37cebcd9