Closed
Bug 1248188
Opened 10 years ago
Closed 10 years ago
Crash due to Assertion Failure : Could not allocate ObjectGroup in EnsureTrackPropertyTypes
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
INVALID
People
(Reporter: spandan.veggalam, Unassigned)
Details
Attachments
(1 file)
|
2.32 KB,
application/javascript
|
Details |
User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Build ID: 20160209234513
Steps to reproduce:
The following testcase crashes on mozilla-central version 7042e8a19f94 (build options --enable-optimize --enable-valgrind --enable-gczeal --enable-debug)
Flags:
1. --baseline-eager --no-fpu --fuzzing-safe -f
2. --baseline-eager --fuzzing-safe -f
Attached the test case that resulted in this bug
Actual results:
Assertion failure: [unhandlable oom] Could not allocate ObjectGroup in EnsureTrackPropertyTypes, at firefox/js/src/jscntxt.cpp:1221 Hit MOZ_CRASH() at firefox/js/src/jscntxt.cpp:1222
|
Reporter | |
Updated•10 years ago
|
Summary: Crash dude to Assertion Failure : Could not allocate ObjectGroup in EnsureTrackPropertyTypes → Crash due to Assertion Failure : Could not allocate ObjectGroup in EnsureTrackPropertyTypes
|
||
Comment 1•10 years ago
|
||
Jan, could you look at this? Jon seems to be away. Thanks.
Flags: needinfo?(jdemooij)
|
||
Updated•10 years ago
|
Group: core-security → javascript-core-security
|
||
Comment 2•10 years ago
|
||
Unhandlable OOMs are not bugs, it just means we ran out of memory and the OOM is either unlikely or difficult to recover from. Please teach your fuzzer to ignore these "[unhandable oom]" failures :)
Group: javascript-core-security
Status: UNCONFIRMED → RESOLVED
Closed: 10 years ago
Flags: needinfo?(jdemooij)
Resolution: --- → INVALID
You need to log in
before you can comment on or make changes to this bug.
Description
•