930526 - Assertion failure: obj, at dist/include/js/Value.h:527 with OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 19fd3388c372 (run with --fuzzing-safe --ion-eager --ion-eager --ion-check-range-analysis):


oomAfterAllocations(1);
var uint32 = TypedObject.uint32;

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Terrence Cole [:terrence]]

Attachment: missing_check_in_InitTypedObjectClass-v0.diff

Trivial. Not really worth the overhead of a test here.

Comment 4

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 5

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/abe5f544e06a

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/abe5f544e06a

Comment 7

[Ioana (away)]

Tested with the 11/01 and 02/04 Firefox 28 JS shells on Ubuntu 13.04 x86. I got the same results with both shells (although the 11/01 one is supposed to reproduce the assertion):
"out of memory
out of memory".