Assertion failure: newMaxNurseryChunks > 0, at js/src/gc/Nursery.cpp:1243
Categories
(Core :: JavaScript: GC, defect, P2)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox-esr60 | --- | unaffected |
| firefox66 | --- | unaffected |
| firefox67 | --- | unaffected |
| firefox68 | --- | fixed |
People
(Reporter: gkw, Assigned: pbone)
References
(Regression)
Details
(4 keywords, Whiteboard: [jsbugmon:update])
Attachments
(3 files)
The following testcase crashes on mozilla-central revision 93075ec49df3 (build with --target=i686-pc-linux --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests --disable-cranelift, run with --fuzzing-safe --no-threads --no-baseline --no-ion):
gcparam('maxNurseryBytes', 2 ** 32 - 1);
Backtrace:
#0 js::Nursery::maybeResizeExact (this=0xf6b1a190, reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/Nursery.cpp:1243
#1 0x57ed0d37 in js::Nursery::maybeResizeNursery (this=0xf6b1a190, reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/Nursery.cpp:1171
#2 0x57ecd94e in js::Nursery::collect (this=0xf6b1a190, reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/Nursery.cpp:795
#3 0x57e5366e in js::gc::GCRuntime::minorGC (this=0xf6b183e8, reason=JS::GCReason::DESTROY_RUNTIME, phase=js::gcstats::PhaseKind::EVICT_NURSERY_FOR_MAJOR_GC) at js/src/gc/GC.cpp:7828
#4 0x57e529e7 in js::gc::GCRuntime::gcCycle (this=0xf6b183e8, nonincrementalByAPI=<optimized out>, budget=..., reason=JS::GCReason::DESTROY_RUNTIME) at js/src/gc/GC.cpp:7403
/snip
For detailed crash information, see attachment.
|
Reporter | |
Comment 1•6 years ago
|
||
|
|
Reporter | |
Comment 2•6 years ago
|
||
autobisectjs shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/8aaeb14dfc0c
user: Paul Bone
date: Fri Mar 22 05:15:38 2019 +0000
summary: Bug 1531626 - (part 4) Always round-nearest for nursery size r=jonco
Paul, is bug 1531626 a likely regressor?
|
Assignee | |
Updated•6 years ago
|
|
|
Assignee | |
Comment 3•6 years ago
|
||
|
||
Updated•6 years ago
|
Pushed by pbone@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/142748fa228e Guard against overflow when calculating the new max chunks r=jonco https://hg.mozilla.org/integration/autoland/rev/8e4e52017c5d Fix a problem with rounding down to zero r=jonco
|
||
Comment 6•6 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/142748fa228e
https://hg.mozilla.org/mozilla-central/rev/8e4e52017c5d
|
||
Updated•6 years ago
|
Description
•