Closed
Bug 1245173
Opened 8 years ago
Closed 8 years ago
Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::MLoadUnboxedScalar::New
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1245160
Tracking | Status | |
---|---|---|
firefox47 | --- | wontfix |
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, Whiteboard: [jsbugmon:ignore])
+++ This bug was initially created as a clone of Bug #1244828 +++ Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default. Line numbers from m-c rev 211a4c710fb6: #0 js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281 #1 js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40 #2 0x00000000005a45df in js::jit::TempObject::operator new (nbytes=192, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174 #3 js::jit::MLoadUnboxedScalar::New (alloc=..., elements=0x5071e18, index=0x5071d60, requiresBarrier=js::jit::DoesNotRequireMemoryBarrier, offsetAdjustment=0, canonicalizeDoubles=255, storageType=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/MIR.h:9677 #4 js::jit::IonBuilder::jsop_getelem_typed (this=0x7ffee5cdefa8, obj=<optimized out>, index=0xe8c28948243c8b48, arrayType=js::Scalar::Int32) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9609 #5 0x000000000058f1cb in js::jit::IonBuilder::getElemTryTypedArray (index=<optimized out>, this=<optimized out>, emitted=<optimized out>, obj=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9113 #6 js::jit::IonBuilder::jsop_getelem (this=0x7ffee5cdefa8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:8558 #7 0x0000000000585cea in js::jit::IonBuilder::inspectOpcode (this=0x7ffee5cdefa8, op=JSOP_GETELEM) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1984 #8 0x0000000000583ebf in js::jit::IonBuilder::traverseBytecode (this=0x7ffee5cdefa8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #9 0x0000000000584720 in js::jit::IonBuilder::buildInline (this=0x7ffee5cdefa8, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089 #10 0x000000000059806e in js::jit::IonBuilder::inlineScriptedCall (this=0x7ffee5cdfac8, callInfo=..., target=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5080 #11 0x000000000059928a in js::jit::IonBuilder::inlineSingleCall (this=0x7ffee5cdfac8, callInfo=..., targetArg=0x7f1baf9f4b80) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5588 #12 0x000000000059951f in js::jit::IonBuilder::inlineCallsite (this=0x7ffee5cdfac8, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5644 #13 0x000000000058d15e in js::jit::IonBuilder::jsop_call (this=0x7ffee5cdfac8, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6581 #14 0x0000000000585ab2 in js::jit::IonBuilder::inspectOpcode (this=0x7ffee5cdfac8, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888 #15 0x0000000000583ebf in js::jit::IonBuilder::traverseBytecode (this=0x7ffee5cdfac8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #16 0x0000000000584720 in js::jit::IonBuilder::buildInline (this=0x7ffee5cdfac8, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089 #17 0x000000000059806e in js::jit::IonBuilder::inlineScriptedCall (this=0x7ffee5ce05e8, callInfo=..., target=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5080 #18 0x000000000059928a in js::jit::IonBuilder::inlineSingleCall (this=0x7ffee5ce05e8, callInfo=..., targetArg=0x7f1baf9f4580) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5588 #19 0x000000000059951f in js::jit::IonBuilder::inlineCallsite (this=0x7ffee5ce05e8, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5644 #20 0x000000000058d15e in js::jit::IonBuilder::jsop_call (this=0x7ffee5ce05e8, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6581 #21 0x0000000000585ab2 in js::jit::IonBuilder::inspectOpcode (this=0x7ffee5ce05e8, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888 #22 0x0000000000583ebf in js::jit::IonBuilder::traverseBytecode (this=0x7ffee5ce05e8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #23 0x0000000000584720 in js::jit::IonBuilder::buildInline (this=0x7ffee5ce05e8, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089 #24 0x000000000059806e in js::jit::IonBuilder::inlineScriptedCall (this=0x4f1ff20, callInfo=..., target=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5080 #25 0x000000000059928a in js::jit::IonBuilder::inlineSingleCall (this=0x4f1ff20, callInfo=..., targetArg=0x7f1baf9f4900) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5588 #26 0x000000000059951f in js::jit::IonBuilder::inlineCallsite (this=0x4f1ff20, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5644 #27 0x000000000058d15e in js::jit::IonBuilder::jsop_call (this=0x4f1ff20, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6581 #28 0x0000000000585ab2 in js::jit::IonBuilder::inspectOpcode (this=0x4f1ff20, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888 #29 0x0000000000583ebf in js::jit::IonBuilder::traverseBytecode (this=0x4f1ff20) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522 #30 0x000000000058096f in js::jit::IonBuilder::build (this=0x4f1ff20) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:918 #31 0x000000000057518b in js::jit::IonCompile (script=<optimized out>, baselineFrame=<optimized out>, osrPc=<optimized out>, optimizationLevel=<optimized out>, cx=<optimized out>, constructing=<optimized out>, recompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2210 #32 js::jit::Compile (cx=0x335b7a0, script=..., osrFrame=<optimized out>, osrPc=<optimized out>, constructing=<optimized out>, forceRecompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2448 #33 0x0000000000575ab8 in BaselineCanEnterAtEntry (cx=0x335b7a0, frame=0x7ffee5ce1418, script=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2573 #34 js::jit::IonCompileScriptForBaseline (cx=0x335b7a0, frame=0x7ffee5ce1418, pc=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2697 #35 0x00007f1bb5a05f00 in ?? () #36 0x0000000000020000 in ?? () #37 0x00007ffee5ce13b8 in ?? () #38 0x00000000033664b8 in ?? () #39 0x000000000179d170 in InterruptCheckInfo () #40 0x00007f1bafa59ca0 in ?? () #41 0x00007f1baf843dab in ?? () #42 0x0000000000000f01 in ?? () #43 0x00007ffee5ce1418 in ?? () #44 0x00000000036416ec in ?? () #45 0x00007ffee5ce1448 in ?? () #46 0xfff9000000000000 in ?? () #47 0xfff9000000000000 in ?? () #48 0xfff9000000000000 in ?? () #49 0xfff9000000000000 in ?? () #50 0xfff9000000000000 in ?? () #51 0x00000000037b3fe0 in ?? () #52 0x0000000004f1fe50 in ?? () #53 0x0000000000000060 in ?? () #54 0x00007f1baf941070 in ?? () #55 0x00007f1bb45cf89c in __GI___libc_free (mem=<optimized out>) at malloc.c:2950 #56 0x0000000000000001 in ?? () #57 0x00007ffee5ce1708 in ?? () #58 0x0000000000000000 in ?? ()
Updated•8 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Updated•8 years ago
|
Updated•3 years ago
|
Assignee: nicolas.b.pierron → nobody
You need to log in
before you can comment on or make changes to this bug.
Description
•