877525 - Crash [@ PropertyAccess<(PropertyAccessKind)0>] with OOM

Status: RESOLVED DUPLICATE of bug 884254

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8d85de779506 (run with --ion-eager):


function test() {
eval("\
  var v = ({ 0 : []});\
  function a() {\
    oomAfterAllocations(1);\
    v.f = function(a) { return o; };\
  }\
  new a;\
");
} test();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

This bug is very annoying and has been around at least since TI, just hard to get a reduced test. The crash seems to indicate that it's somewhat related to types:


Program received signal SIGSEGV, Segmentation fault.
PropertyAccess<(PropertyAccessKind)0> (cx=0x92695b0, object=0xf74301e0, target=0x92e6128, idArg=$jsid("f"), script=<optimized out>, pc=<optimized out>) at js/src/jsinfer.cpp:1222
1222        if (object->singleton && object->singleton->isTypedArray() && JSID_IS_VOID(id)) {
#0  PropertyAccess<(PropertyAccessKind)0> (cx=0x92695b0, object=0xf74301e0, target=0x92e6128, idArg=$jsid("f"), script=<optimized out>, pc=<optimized out>) at js/src/jsinfer.cpp:1222
#1  0x0813e975 in resolvePending (cx=0x92695b0, this=0x9267948) at ../jsinferinlines.h:1147
#2  js::types::TypeSet::addType (this=0x92867d8, cx=0x92695b0, type=...) at ../jsinferinlines.h:1466
#3  0x0825f75d in js::types::TypeMonitorResult (cx=0x92695b0, script=0xf7437230, pc=0x927a3a5 ";", rval=...) at js/src/jsinfer.cpp:5735
#4  0x083e801c in Monitor (rval=..., pc=0x927a3a5 ";", script=<optimized out>, cx=0x92695b0) at ../jsinferinlines.h:962
#5  js::ion::DoGetNameFallback (cx=0x92695b0, frame=0xffffb40c, stub=0x9286370, scopeChain=(JSObject * const) 0xf7440550 [object Call] delegate, res=$jsval(-nan(0xfff87f7435050))) at js/src/ion/BaselineIC.cpp:4843
#6  0xf7fd078f in ?? ()
#7  0xf7fc7f94 in ?? ()


Ccing Brian since it could be related to older TI code.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b3cbafd5eb99).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 7ba8c86f1a56).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f822fe6c9708
user:        Brian Hackett
date:        Thu Jun 20 13:01:49 2013 -0600
summary:     Bug 884254 - Don't update observed type sets when analyzeTypes is called during compilation, r=jandem.

This iteration took 334.374 seconds to run.

Comment 5

[Christian Holler (:decoder)]

Brian, could the patch in comment 4 be a fix for this issue too?

Comment 6

[Brian Hackett [Laid off!]]

Sure