777186 - IonMonkey: OOM Testing: Crash [@ js::ion::MBasicBlock::entryResumePoint]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build):

js  -e 'const libdir = "js/src/jit-test/lib/";' -A 14914 -f js/src/jit-test/tests/v8-v5/check-richards.js

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to Christian Holler (:decoder) from comment #0)
> The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build):
> 
> js  -e 'const libdir = "js/src/jit-test/lib/";' -A 14914 -f
> js/src/jit-test/tests/v8-v5/check-richards.js

I can't reproduce this on the given cset. Could you show the backtrace?

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

NULL check is missing on line 2945 (bottom = newBlock) of IonBuilder.cpp.

Comment 3

[Sean Stangl [:sstangl]]

Attachment: fix

Comment 4

[Sean Stangl [:sstangl]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/3073e4bb03ff

Comment 5

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/3073e4bb03ff