Closed
Bug 1287344
Opened 9 years ago
Closed 8 years ago
Crash [@ js::frontend::Definition::kind]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(2 files)
The following testcase crashes on mozilla-central revision 711963e8daa3 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):
// Adapted from randomly chosen test: js/src/tests/ecma_6/Comprehensions/generator-semantics.js
oomTest(function(y) {
load("testcase.js");
})
and testcase.js is:
function f() {
return [for (i of (for (j of[]) {}))
function g() {
return [for (x of (for (i of[0]) {}))]
}]
}
Backtrace:
0 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010dde6526 js::frontend::Definition::kind() + 6 (ParseNode.h:1666)
1 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010d374121 js::frontend::ParseContext<js::frontend::FullParseHandler>::popLetDecl(JSAtom*) + 33 (Parser.cpp:480)
2 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010d34160c js::frontend::Parser<js::frontend::FullParseHandler>::AutoPushStmtInfoPC::~AutoPushStmtInfoPC() + 556 (Parser.cpp:3862)
3 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010d35923e js::frontend::Parser<js::frontend::FullParseHandler>::comprehensionFor(js::GeneratorKind) + 2078 (Parser.cpp:3937)
4 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010d359e4c js::frontend::Parser<js::frontend::FullParseHandler>::arrayComprehension(unsigned int) + 60 (Parser.cpp:8561)
5 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010d356447 js::frontend::Parser<js::frontend::FullParseHandler>::arrayInitializer(js::frontend::YieldHandling) + 263 (Parser.cpp:9012)
6 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010d3515f7 js::frontend::Parser<js::frontend::FullParseHandler>::primaryExpr(js::frontend::YieldHandling, js::frontend::TripledotHandling, js::frontend::Parser<js::frontend::FullParseHandler>::PossibleError*, js::frontend::TokenKind, js::frontend::Parser<js::frontend::FullParseHandler>::InvokedPrediction) + 887 (Parser.cpp:9514)
7 js-dbg-64-dm-clang-darwin-711963e8daa3 0x000000010d354a16 js::frontend::Parser<js::frontend::FullParseHandler>::memberExpr(js::frontend::YieldHandling, js::frontend::TripledotHandling, js::frontend::Parser<js::frontend::FullParseHandler>::PossibleError*, js::frontend::TokenKind, bool, js::frontend::Parser<js::frontend::FullParseHandler>::InvokedPrediction) + 806 (Parser.cpp:8753)
/snip
For detailed crash information, see attachment.
![]() |
Reporter | |
Comment 1•9 years ago
|
||
![]() |
Reporter | |
Comment 2•9 years ago
|
||
autoBisect only points back to the introduction of oomTest:
=== Treeherder Build Bisection Results by autoBisect ===
The "good" changeset has the timestamp "20151013053056" and the hash "8d9c20c241be7d7b3cfa90a3368a77db42172781".
The "bad" changeset has the timestamp "20151013054956" and the hash "d80f9d6921f8209ef01aa730be9a97ab727704d1".
Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8d9c20c241be7d7b3cfa90a3368a77db42172781&tochange=d80f9d6921f8209ef01aa730be9a97ab727704d1
Attaching the OOM_VERBOSE=1 stack may help instead. Since this is Parser territory, setting needinfo? from :jorendorff and :Waldo instead.
Flags: needinfo?(jwalden+bmo)
Flags: needinfo?(jorendorff)
Comment 3•9 years ago
|
||
This involves definitions, which means it's hairy-old-parser territory. Should regroup on this after the new parser lands.
Depends on: 1263355
Flags: needinfo?(jwalden+bmo)
![]() |
Reporter | |
Comment 4•8 years ago
|
||
(In reply to Jeff Walden [:Waldo] (remove +bmo to email) from comment #3)
> This involves definitions, which means it's hairy-old-parser territory.
> Should regroup on this after the new parser lands.
The new parser stuff in bug 1263355 has landed. What's next?
(re-setting ni? from Waldo, setting ni? from Shu-yu because he fixed bug 1263355...)
Flags: needinfo?(shu)
Flags: needinfo?(jwalden+bmo)
![]() |
Reporter | |
Comment 6•8 years ago
|
||
Due to skipped revisions, the first good revision could be any of:
changeset: https://hg.mozilla.org/mozilla-central/rev/cb6fc6d38f8d
user: Shu-yu Guo
date: Thu Aug 25 01:28:47 2016 -0700
summary: Bug 1263355 - Rewrite the frontend: bindings. (r=jorendorff,Waldo)
changeset: https://hg.mozilla.org/mozilla-central/rev/18bec78f348e
user: Shu-yu Guo
date: Thu Aug 25 01:28:47 2016 -0700
summary: Bug 1263355 - Report memory metrics for Scopes. (r=njn)
No, it no longer seems to occur, and resolving FIXED as per comment 5 and this fix window.
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(jwalden+bmo)
Flags: needinfo?(jorendorff)
Resolution: --- → FIXED
![]() |
Reporter | |
Updated•8 years ago
|
status-firefox51:
--- → fixed
You need to log in
before you can comment on or make changes to this bug.
Description
•