1109328 - Crash [@ js::jit::BaselineCompiler::emitBody] or [@ js::jit::Assembler::toggledCall] or [jsdbg2] Fix an OOM handling case during debug mode OSR

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Shu-yu Guo [:shu]]

When doing debug mode OSR, going OOM when trying to get the debug trap handler in BaselineCompiler is incorrectly ignored.

Comment 1

[Shu-yu Guo [:shu]]

Attachment: Fix an OOM case when compiling debug instrumentation in Baseline.

I would like a test for this, but I can't reduce the fuzz test or come up with
one that goes OOM at precisely the right point.

Also fixes a bug in Debugger where we the frame map isn't correctly synced if
ensureObservability failed.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    gcslice(0)(""());
} catch (e) {}
g = newGlobal()
g.parent = this
g.eval("Debugger(parent).onExceptionUnwind=(function(){})");
gcparam("maxBytes", gcparam("gcBytes"));
$

crashes js debug shell on m-i rev 96b86345fe30 with --fuzzing-safe --no-threads --ion-eager at js::jit::Assembler::toggledCall

(Shu-yu gave me access to the testcase, I merely helped to reduce, so credit goes to Langfuzz)

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-inbound/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/049230caef34

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Fixed for Fx36 by the roll-up in bug 1114757.