Closed
Bug 1245172
Opened 8 years ago
Closed 8 years ago
Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::MToInt32::New
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1245160
Tracking | Status | |
---|---|---|
firefox47 | --- | wontfix |
People
(Reporter: gkw, Assigned: nbp)
References
Details
(Keywords: assertion, regression, Whiteboard: [jsbugmon:ignore])
+++ This bug was initially created as a clone of Bug #1244828 +++ Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default. Line numbers from m-c rev 54eea211e234: #0 js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=144) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281 #1 js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=144) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40 #2 js::jit::TempObject::operator new (nbytes=144, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174 #3 js::jit::MToInt32::New (alloc=..., def=0x5d417d8, conversion=js::jit::MacroAssembler::IntConversion_Any) at /home/ubuntu/trees/mozilla-central/js/src/jit/MIR.h:5182 #4 js::jit::IonBuilder::jsop_getelem_dense (this=<optimized out>, obj=<optimized out>, index=0x5d417d8, unboxedType=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9379 #5 0x00000000006ec1af in js::jit::IonBuilder::getElemTryDense (this=0x7ffea1edc1d0, emitted=0x7ffea1edbecf, obj=0x5d3b2b8, index=0x5d417d8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9000 #6 0x00000000006d5d10 in js::jit::IonBuilder::jsop_getelem (this=0x7ffea1edc1d0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:8550 #7 0x00000000006caaa5 in js::jit::IonBuilder::inspectOpcode (this=0x7ffea1edc1d0, op=JSOP_GETELEM) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1984 #8 0x00000000006c8026 in js::jit::IonBuilder::traverseBytecode (this=0x7ffea1edc1d0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #9 0x00000000006c90ef in js::jit::IonBuilder::buildInline (this=0x7ffea1edc1d0, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089 #10 0x00000000006e1f16 in js::jit::IonBuilder::inlineScriptedCall (this=0x7ffea1edcfe0, callInfo=..., target=0x4048c20) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5080 #11 0x00000000006e3acf in js::jit::IonBuilder::inlineSingleCall (this=0x7ffea1edcfe0, callInfo=..., targetArg=0x7fc698687ec0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5588 #12 0x00000000006e3d76 in js::jit::IonBuilder::inlineCallsite (this=0x7ffea1edcfe0, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5644 #13 0x00000000006d38cb in js::jit::IonBuilder::jsop_call (this=0x7ffea1edcfe0, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6581 #14 0x00000000006ca7cf in js::jit::IonBuilder::inspectOpcode (this=0x7ffea1edcfe0, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888 #15 0x00000000006c8026 in js::jit::IonBuilder::traverseBytecode (this=0x7ffea1edcfe0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #16 0x00000000006c90ef in js::jit::IonBuilder::buildInline (this=0x7ffea1edcfe0, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089 #17 0x00000000006e1f16 in js::jit::IonBuilder::inlineScriptedCall (this=0x4048e50, callInfo=..., target=0x4048c20) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5080 #18 0x00000000006e3acf in js::jit::IonBuilder::inlineSingleCall (this=0x4048e50, callInfo=..., targetArg=0x7fc698699cc0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5588 #19 0x00000000006e3d76 in js::jit::IonBuilder::inlineCallsite (this=0x4048e50, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5644 #20 0x00000000006d38cb in js::jit::IonBuilder::jsop_call (this=0x4048e50, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6581 #21 0x00000000006ca7cf in js::jit::IonBuilder::inspectOpcode (this=0x4048e50, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888 #22 0x00000000006c8026 in js::jit::IonBuilder::traverseBytecode (this=0x4048e50) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #23 0x00000000006c2ee5 in js::jit::IonBuilder::build (this=0x4048e50) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:918 #24 0x00000000006a3946 in js::jit::IonCompile (cx=0x28c24f0, script=<optimized out>, baselineFrame=<optimized out>, osrPc=<optimized out>, optimizationLevel=<optimized out>, constructing=<optimized out>, recompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2210 #25 js::jit::Compile (cx=0x28c24f0, script=..., osrFrame=<optimized out>, osrPc=<optimized out>, constructing=160, forceRecompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2448 #26 0x00000000006a488e in BaselineCanEnterAtEntry (cx=0x28c24f0, frame=0x7ffea1ede128, script=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2573 #27 js::jit::IonCompileScriptForBaseline (cx=0x28c24f0, frame=0x7ffea1ede128, pc=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2697 #28 0x00007fc69f2486bb in ?? () #29 0x0000000000000000 in ?? ()
Assignee | ||
Updated•8 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Updated•8 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•