ARM64: OOM errors in Assembler::emitExtendedJumpTable

RESOLVED FIXED in Firefox 44

Status

()

Core
JavaScript Engine: JIT
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: jolesen, Assigned: jolesen)

Tracking

unspecified
mozilla44
ARM
Unspecified
Points:
---

Firefox Tracking Flags

(firefox44 fixed)

Details

Attachments

(1 attachment)

(Assignee)

Description

2 years ago
Build SpiderMonkey with --enable-simulator=arm64.
Run jit_test with "--no-ion --no-asmjs --baseline-eager"

Results: Assertions like:
Assertion failure: prePointer - preOffset == OffsetOfJumpTableEntryPointer, at /Users/jolesen/gecko-dev/js/src/jit/arm64/Assembler-arm64.cpp:127

Failing tests (among others):

js/src/jit-test/tests/gc/oomInParseAsmJS.js
js/src/jit-test/tests/gc/oomInParseFunction.js
js/src/jit-test/tests/gc/oomInWeakMap.js
(Assignee)

Comment 1

2 years ago
Created attachment 8677715 [details] [diff] [review]
Handle OOM in Assembler::emitExtendedJumpTable().

Assertions would trip if the assembler buffer runs out of memory midway
through the jump table.
Attachment #8677715 - Flags: review?(sstangl)

Updated

2 years ago
Attachment #8677715 - Flags: review?(sstangl) → review+
https://hg.mozilla.org/mozilla-central/rev/36e27dc524a4
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox44: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla44
You need to log in before you can comment on or make changes to this bug.