842988 - BaselineCompiler: Opt-only Crash [@ ICStub] with OOM

Status: RESOLVED DUPLICATE of bug 841759

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase crashes on baseline compiler branch revision 9f5b009345f7 (run with --ion-eager).

Comment 1

[Christian Holler (:decoder)]

Stack from opt build:

Program received signal SIGSEGV, Segmentation fault.
0x00000000006ee458 in ICStub (kind=js::ion::ICStub::Compare_NumberWithUndefined, this=0xc22150, stubCode=0x0) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.h:444
444             next_(NULL)
(gdb) bt
#0  0x00000000006ee458 in ICStub (kind=js::ion::ICStub::Compare_NumberWithUndefined, this=0xc22150, stubCode=0x0) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.h:444
#1  ICCompare_NumberWithUndefined (this=0xc22150, stubCode=0x0) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.h:1588
#2  allocate<js::ion::ICCompare_NumberWithUndefined, js::ion::IonCode*> (this=0xbb4f10, p1=0x0) at /srv/repos/ionmonkey/js/src/ion/BaselineJIT.h:42
#3  New (code=0x0, space=0xbb4f10) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.h:1593
#4  js::ion::ICCompare_ObjectWithUndefined::Compiler::getStub (this=<optimized out>, space=0xbb4f10) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.h:1739
#5  0x00000000006f441b in js::ion::DoCompareFallback (cx=0xba4ca0, stub=0xbb46c8, lhs=JSVAL_VOID, rhs=JSVAL_VOID, ret=JSVAL_TRUE) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.cpp:1442
#6  0x00007ffff7fef250 in ?? ()

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 987e7a479c76).