875113 - OdinMonkey: in asm.js mode, spewing crashes the shell

Status: RESOLVED DUPLICATE of bug 871242

(Core :: JavaScript Engine, defect)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

Using the shell, when log informations are asked and a asm.js script is launched, the shell will segfault. This is unfortunate as we can't use the log information and therefore run IonGraph on them.

$ IONFLAGS=regalloc ./js ~/AsmJSscript.js
> Segmentation fault (core dumped)

$ IONFLAGS=logs ./js ~/AsmJSscript.js
> Segmentation fault (core dumped)

The reason is that there is no JSContext when creating an IonContext, in AsmJS.cpp:CheckFunctionBodiesSequential. The JSContext is getting used for a memory allocation when initializing the Sprinter.

Any quick ideas about this:
- Make Sprinter use the LifoAlloc instead of the JSContext to allocate memory.
- Create the IonContext with m.cx() instead of m.cx()->compartment (side effects expected).

Comment 1

[Douglas Crosher [:dougc]]

This looks like a duplicate of Bug 871242 and there is a patch there that may allow you to continue work.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

You are right, I didn't see Bug 871242 when I looked for eventual duplicates. Thanks!