Closed Bug 1248219 Opened 8 years ago Closed 8 years ago

Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::MTypedArrayLength::New

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1245160
Tracking Flags:
Tracking Status
firefox47 --- wontfix

People

(Reporter: gkw, Assigned: nbp)

References

Details

(Keywords: assertion, regression, Whiteboard: [jsbugmon:ignore]) 

Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default.

Line numbers from m-c rev d719ac4bcbec:

#0  js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281
#1  js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40
#2  0x00000000005b4061 in js::jit::TempObject::operator new (nbytes=136, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174
#3  js::jit::MTypedArrayLength::New (alloc=..., obj=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/MIR.h:8494
#4  js::jit::IonBuilder::addTypedArrayLengthAndData (this=0x7fff7bf7dee8, obj=0x355b920, checking=js::jit::IonBuilder::DoBoundsCheck, index=0x7fff7bf7dcb0, length=0x7fff7bf7dca8, elements=0x7fff7bf7dca0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9530
#5  0x00000000005b34d7 in js::jit::IonBuilder::jsop_getelem_typed (this=0x7fff7bf7dee8, obj=0x7fc003b2a960 <_IO_stdfile_2_lock>, index=0xe8c28948243c8b48, arrayType=js::Scalar::Int32) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9637
#6  0x000000000059df9b in js::jit::IonBuilder::getElemTryTypedArray (index=<optimized out>, this=<optimized out>, emitted=<optimized out>, obj=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:9144
#7  js::jit::IonBuilder::jsop_getelem (this=0x7fff7bf7dee8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:8589
#8  0x0000000000594aca in js::jit::IonBuilder::inspectOpcode (this=0x7fff7bf7dee8, op=JSOP_GETELEM) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1984
#9  0x0000000000592ccf in js::jit::IonBuilder::traverseBytecode (this=0x7fff7bf7dee8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522
#10 0x0000000000593520 in js::jit::IonBuilder::buildInline (this=0x7fff7bf7dee8, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089
#11 0x00000000005a6fa2 in js::jit::IonBuilder::inlineScriptedCall (this=0x7fff7bf7e9f8, callInfo=..., target=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5111
#12 0x00000000005a81ba in js::jit::IonBuilder::inlineSingleCall (this=0x7fff7bf7e9f8, callInfo=..., targetArg=0x7fbffea89100) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5619
#13 0x00000000005a844c in js::jit::IonBuilder::inlineCallsite (this=0x7fff7bf7e9f8, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5675
#14 0x000000000059bf2e in js::jit::IonBuilder::jsop_call (this=0x7fff7bf7e9f8, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6612
#15 0x0000000000594892 in js::jit::IonBuilder::inspectOpcode (this=0x7fff7bf7e9f8, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888
#16 0x0000000000592ccf in js::jit::IonBuilder::traverseBytecode (this=0x7fff7bf7e9f8) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522
#17 0x0000000000593520 in js::jit::IonBuilder::buildInline (this=0x7fff7bf7e9f8, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089
#18 0x00000000005a6fa2 in js::jit::IonBuilder::inlineScriptedCall (this=0x7fff7bf7f508, callInfo=..., target=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5111
#19 0x00000000005a81ba in js::jit::IonBuilder::inlineSingleCall (this=0x7fff7bf7f508, callInfo=..., targetArg=0x7fbffea87ac0) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5619
#20 0x00000000005a844c in js::jit::IonBuilder::inlineCallsite (this=0x7fff7bf7f508, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5675
#21 0x000000000059bf2e in js::jit::IonBuilder::jsop_call (this=0x7fff7bf7f508, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6612
#22 0x0000000000594892 in js::jit::IonBuilder::inspectOpcode (this=0x7fff7bf7f508, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888
#23 0x0000000000592ccf in js::jit::IonBuilder::traverseBytecode (this=0x7fff7bf7f508) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522
#24 0x0000000000593520 in js::jit::IonBuilder::buildInline (this=0x7fff7bf7f508, callerBuilder=<optimized out>, callerResumePoint=<optimized out>, callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1089
#25 0x00000000005a6fa2 in js::jit::IonBuilder::inlineScriptedCall (this=0x336a110, callInfo=..., target=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5111
#26 0x00000000005a81ba in js::jit::IonBuilder::inlineSingleCall (this=0x336a110, callInfo=..., targetArg=0x7fbffea87e40) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5619
#27 0x00000000005a844c in js::jit::IonBuilder::inlineCallsite (this=0x336a110, targets=..., callInfo=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:5675
#28 0x000000000059bf2e in js::jit::IonBuilder::jsop_call (this=0x336a110, argc=<optimized out>, constructing=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:6612
#29 0x0000000000594892 in js::jit::IonBuilder::inspectOpcode (this=0x336a110, op=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1888
#30 0x0000000000592ccf in js::jit::IonBuilder::traverseBytecode (this=0x336a110) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:1522
#31 0x000000000058f7af in js::jit::IonBuilder::build (this=0x336a110) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonBuilder.cpp:918
#32 0x0000000000583d94 in js::jit::IonCompile (script=<optimized out>, baselineFrame=<optimized out>, osrPc=<optimized out>, optimizationLevel=<optimized out>, cx=<optimized out>, constructing=<optimized out>, recompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2195
#33 js::jit::Compile (cx=0x2f7ccd0, script=..., osrFrame=<optimized out>, osrPc=<optimized out>, constructing=<optimized out>, forceRecompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2433
#34 0x00000000005846ca in BaselineCanEnterAtEntry (cx=0x2f7ccd0, frame=0x7fff7bf80348, script=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2558
#35 js::jit::IonCompileScriptForBaseline (cx=0x2f7ccd0, frame=0x7fff7bf80348, pc=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2682
#36 0x00007fc004c1ef00 in ?? ()
#37 0x00007fff7bf80358 in ?? ()
#38 0x00007fff7bf802c8 in ?? ()
#39 0x00007fbffea8f7f0 in ?? ()
#40 0x00000000017ad850 in InterruptCheckInfo ()
#41 0x00007fbffea5dca0 in ?? ()
#42 0x00007fbffe7a032f in ?? ()
#43 0x0000000000009821 in ?? ()
#44 0x00007fff7bf80348 in ?? ()
#45 0x00000000032953ac in ?? ()
#46 0x00007fff7bf80378 in ?? ()
#47 0xfff9000000000000 in ?? ()
#48 0xfff9000000000000 in ?? ()
#49 0xfff9000000000000 in ?? ()
#50 0xfff9000000000000 in ?? ()
#51 0xfff9000000000000 in ?? ()
#52 0xfff9000000000000 in ?? ()
#53 0xfff9000000000000 in ?? ()
#54 0xfff9000000000000 in ?? ()
#55 0xfff9000000000000 in ?? ()
#56 0x000000000092281c in JSRope::new_<(js::AllowGC)1> (length=<optimized out>, cx=<optimized out>, left=..., right=...) at /home/ubuntu/trees/mozilla-central/js/src/vm/String-inl.h:128
#57 js::ConcatStrings<(js::AllowGC)1> (cx=0x2, left=..., right=...) at /home/ubuntu/trees/mozilla-central/js/src/vm/String.cpp:628
#58 0x0000000000000002 in ?? ()
#59 0xfff9000000000000 in ?? ()
#60 0xfff880000000000d in ?? ()
#61 0xfffc7fbffeb4c438 in ?? ()
#62 0xfff8800000000008 in ?? ()
#63 0x00007fff7bf80448 in ?? ()
#64 0x0000000003168dc0 in ?? ()
#65 0x00007fbffe7aad39 in ?? ()
#66 0x0000000000007021 in ?? ()
#67 0xfffc7fbffeb4c438 in ?? ()
#68 0xfff880000000000d in ?? ()
#69 0xfff9000000000000 in ?? ()
#70 0xfffc7fbffea9cd80 in ?? ()
#71 0xfff9000000000000 in ?? ()
#72 0xfffaffbffe8b68f8 in ?? ()
#73 0x4014000000000000 in ?? ()
#74 0x0000000002f7cd48 in ?? ()
#75 0x0000000002f7ccd0 in ?? ()
#76 0x0000000000000070 in ?? ()
#77 0x00007fbffea68070 in ?? ()
#78 0x00000000032b4ed0 in ?? ()
#79 0x00000000feaa80c0 in ?? ()
#80 0x00007fff7bf80488 in ?? ()
#81 0x00007fc004a7da04 in ?? ()
#82 0x0000000000002842 in ?? ()
#83 0x00007fbffeaa80c0 in ?? ()
#84 0x0000000000000002 in ?? ()
#85 0xfff9000000000000 in ?? ()
#86 0xfff880000000000e in ?? ()
#87 0xfffc7fbffeb4c438 in ?? ()
#88 0x00007fff7bf804f8 in ?? ()
#89 0x00000000033eed38 in ?? ()
#90 0x00007fbffe7cbb0c in ?? ()
#91 0x0000000000005821 in ?? ()
#92 0xfffc7fbffeb4c438 in ?? ()
#93 0xfff880000000000e in ?? ()
#94 0xfff9000000000000 in ?? ()
#95 0xfffc7fbffeaa80c0 in ?? ()
#96 0x00007fbffe7c6640 in ?? ()
#97 0x00007fbffe7c6640 in ?? ()
#98 0xfff8800000000058 in ?? ()
#99 0x00007fbffea68070 in ?? ()
#100 0x00007fbffe7c665d in ?? ()
#101 0x00000000fea1c040 in ?? ()
#102 0x00007fff7bf80540 in ?? ()
#103 0x00007fc004a7da04 in ?? ()
#104 0x0000000000003042 in ?? ()
#105 0x00007fbffea917c0 in ?? ()
#106 0x0000000000000002 in ?? ()
#107 0xfff9000000000000 in ?? ()
#108 0xfff880000000000e in ?? ()
#109 0xfff9000000000000 in ?? ()
#110 0x0000000000001842 in ?? ()
#111 0x00007fff7bf805b8 in ?? ()
#112 0x00000000033ff700 in ?? ()
#113 0x00007fbffe7cb3f5 in ?? ()
#114 0x0000000000006021 in ?? ()
#115 0xfff9000000000000 in ?? ()
#116 0xfff880000000000e in ?? ()
#117 0xfff9000000000000 in ?? ()
#118 0xfffc7fbffea917c0 in ?? ()
#119 0xfffaffbffea1c040 in ?? ()
#120 0x000000000000001c in ?? ()
#121 0x000000000315b938 in ?? ()
#122 0xfffa000000000060 in ?? ()
#123 0x00007fbffea68070 in ?? ()
#124 0xfff9000000000000 in ?? ()
#125 0x0000000000000000 in ?? ()
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.