Closed Bug 777186 Opened 7 years ago Closed 7 years ago

IonMonkey: OOM Testing: Crash [@ js::ion::MBasicBlock::entryResumePoint]

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla18

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: crash, testcase, Whiteboard: [ion:p2])

Crash Data

Attachments

(1 file)

The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build):

js  -e 'const libdir = "js/src/jit-test/lib/";' -A 14914 -f js/src/jit-test/tests/v8-v5/check-richards.js
(In reply to Christian Holler (:decoder) from comment #0)
> The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build):
> 
> js  -e 'const libdir = "js/src/jit-test/lib/";' -A 14914 -f
> js/src/jit-test/tests/v8-v5/check-richards.js

I can't reproduce this on the given cset. Could you show the backtrace?
NULL check is missing on line 2945 (bottom = newBlock) of IonBuilder.cpp.
Whiteboard: [ion:p2]
Attached patch fixSplinter Review
Attachment #662376 - Flags: review?(dvander)
Attachment #662376 - Flags: review?(dvander) → review+
https://hg.mozilla.org/mozilla-central/rev/3073e4bb03ff
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
You need to log in before you can comment on or make changes to this bug.