620185 - crash [@ Tracker::addTrackerPage] on oom

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[timeless]

1055 Tracker::addTrackerPage(const void* v)
1058     struct TrackerPage* p = (struct TrackerPage*) js_calloc(sizeof(*p));
1059     p->base = base;

Comment 1

[timeless]

Attachment: incomplete markings

i'm not going to claim ownership of this bug.

this patch shows some of the fan out from this code. i'm entirely uncertain as to which things can actually fail so i probably got most of them wrong.

Comment 2

[Nicholas Nethercote [inactive]]

Comment on attachment 498594 [details] [diff] [review]
incomplete markings

>@@ -3849,10 +3857,10 @@ TraceRecorder::checkForGlobalObjectReall
>     LIns** map = (LIns**)alloca(sizeof(LIns*) * length);
>     for (jsuint n = 0; n < length; ++n) {
>         map[n] = tracker.get(src);
>-        tracker.set(src++, NULL);
>+        JS_ALWAYS_TRUE(tracker.set(src++, NULL));
>     }

JS_ALWAYS_TRUE is a synonym for JS_ASSERT -- no side-effects in assertions, please! :)

Comment 3

[Nicholas Nethercote [inactive]]

(In reply to comment #2)
> 
> JS_ALWAYS_TRUE is a synonym for JS_ASSERT -- no side-effects in assertions,
> please! :)

mrbkap politely pointed out I'm wrong about this -- under opt builds, JS_ALWAYS_TRUE is not removed, so the above code is ok.  Sorry for the noise.

Comment 4

[Tom S [:evilpie]]

Tracer has been removed.