Closed
Bug 1245169
Opened 8 years ago
Closed 8 years ago
Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::MTypeBarrier::New
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1245160
Tracking | Status | |
---|---|---|
firefox47 | --- | wontfix |
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, Whiteboard: [jsbugmon:ignore])
+++ This bug was initially created as a clone of Bug #1244828 +++ Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default. Line numbers from m-c rev a1b94785b484: #0 js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=144) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281 #1 js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=144) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40 #2 js::jit::TempObject::operator new (nbytes=144, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174 #3 js::jit::MTypeBarrier::New (alloc=..., def=<optimized out>, types=<optimized out>, kind=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/MIR.h:12646 #4 js::jit::IonBuilder::addTypeBarrier (this=<optimized out>, def=<optimized out>, observed=<optimized out>, kind=<optimized out>, pbarrier=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:7983 #5 0x00000000006e76e0 in js::jit::IonBuilder::pushTypeBarrier (this=0x3ccd4d0, def=<optimized out>, observed=0x3cce160, kind=js::jit::BarrierKind::TypeTagOnly) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:7946 #6 0x00000000006ec27f in js::jit::IonBuilder::getElemTryDense (this=0x3ccd4d0, emitted=0x7ffcddc3d45f, obj=0x376a9f0, index=0x376a960) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9000 #7 0x00000000006d5de0 in js::jit::IonBuilder::jsop_getelem (this=0x3ccd4d0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:8550 #8 0x00000000006cab75 in js::jit::IonBuilder::inspectOpcode (this=0x3ccd4d0, op=JSOP_GETELEM) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1984 #9 0x00000000006c80f6 in js::jit::IonBuilder::traverseBytecode (this=0x3ccd4d0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #10 0x00000000006c2fb5 in js::jit::IonBuilder::build (this=0x3ccd4d0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:918 #11 0x00000000006a3a16 in js::jit::IonCompile (cx=0x23e54f0, script=<optimized out>, baselineFrame=<optimized out>, osrPc=<optimized out>, optimizationLevel=<optimized out>, constructing=<optimized out>, recompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2210 #12 js::jit::Compile (cx=0x23e54f0, script=..., osrFrame=<optimized out>, osrPc=<optimized out>, constructing=160, forceRecompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2448 #13 0x00000000006a4a7c in BaselineCanEnterAtBranch (cx=0x23e54f0, osrFrame=0x7ffcddc3db78, pc=0x273aa83 "\343\201V", script=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2635 #14 js::jit::IonCompileScriptForBaseline (cx=0x23e54f0, frame=0x7ffcddc3db78, pc=0x273aa83 "\343\201V") at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2694 #15 0x00000000005d21fc in js::jit::DoWarmUpCounterFallbackOSR (cx=0x23e54f0, frame=0x7ffcddc3db78, stub=0x334d050, infoPtr=0x7ffcddc3db08) at /home/ubuntu/trees/mozilla-central/js/src/jit/BaselineIC.cpp:140 #16 0x00007f268b09be5f in ?? () #17 0x0000000000000000 in ?? ()
Updated•8 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Updated•8 years ago
|
Updated•3 years ago
|
Assignee: nicolas.b.pierron → nobody
You need to log in
before you can comment on or make changes to this bug.
Description
•