GenerationalGC: Assertion failure: currentStart_ == start(), at gc/Nursery.cpp:103 with OOM

RESOLVED FIXED in mozilla29

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: jonco)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla29
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:ignore])

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 325c74addeba (run with --fuzzing-safe):


gczeal(7,1);
try {
gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
newGlobal("same-compartment");
} catch(exc1) {}
gczeal(1);
(Assignee)

Updated

4 years ago
Assignee: nobody → jcoppeard
(Assignee)

Comment 1

4 years ago
Created attachment 8357785 [details] [diff] [review]
bug957110-nursery-empty-assertion

This testcase turns on nursery zeal mode and then sets a low gcMaxBytes allocation threshold.  This results in the nursery being disabled after attempting to allocate the new global.  When we leave nursery zeal mode, the current chunk is not set to zero because the nursery is disabled.  This is not actually a problem because it will be set when the nursery is re-enabled again.  So the fix is to weaken the failing assert so that it the current start is not checked if the nursery is disabled.
Attachment #8357785 - Flags: review?(terrence)
Comment on attachment 8357785 [details] [diff] [review]
bug957110-nursery-empty-assertion

Review of attachment 8357785 [details] [diff] [review]:
-----------------------------------------------------------------

I could have sworn I found and fixed the same issue when testing the zeal7 robustness rewrite a few months ago. Oh well, this is the correct fix. r=me
Attachment #8357785 - Flags: review?(terrence) → review+
(Assignee)

Comment 3

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/cbe9f7791348
https://hg.mozilla.org/mozilla-central/rev/cbe9f7791348
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
You need to log in before you can comment on or make changes to this bug.