Assertion failure: !global->nativeLookup(cx, id), at ../jsobjinlines.h:1717 with OOM

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
5 years ago
2 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(firefox24 affected, firefox25 affected, firefox26 affected, firefox27 affected)

Details

(Whiteboard: [jsbugmon:update,ignore])

Attachments

(1 attachment, 2 obsolete attachments)

(Reporter)

Description

5 years ago
The following testcase asserts on mozilla-central revision 05533d50f2f7 (run with --ion-eager):


try {
  gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
  new this;
} catch(exc0) {}
function f(o) {
  Float32Array += ''        
}
f();
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 1

5 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   129593:ee14945b452c
parent:      128511:d989eab66df4
user:        Brian Hackett
date:        Thu Apr 11 18:39:32 2013 -0600
summary:     Bug 804676 - Remove dependence of Ion compilation on ScriptAnalysis::analyzeTypes.

This iteration took 13.129 seconds to run.

Oops! We didn't test rev d989eab66df4, a parent of the blamed revision! Let's do that now.
Rev d989eab66df4: Found cached shell...   Testing... [Uninteresting] It didn't crash. (0.039 seconds)
good (not interesting) 
As expected, the parent's label is the opposite of the blamed rev's label.
(Reporter)

Comment 2

5 years ago
Brian, can you take a look? :)
This doesn't have anything to do with bug 804676.  The OOMs are happening inside typed array initialization code, it looks like the class wasn't fully initialized.
(Reporter)

Comment 4

5 years ago
Created attachment 754422 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 5

5 years ago
Created attachment 758762 [details]
[crash-signature] Machine-readable crash signature
Attachment #754422 - Attachment is obsolete: true
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Comment 6

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 9ca690835a5e).
(Reporter)

Updated

5 years ago
status-firefox24: --- → affected
(Reporter)

Updated

5 years ago
status-firefox25: --- → affected
status-firefox26: --- → affected
status-firefox27: --- → affected
(Reporter)

Comment 7

4 years ago
Created attachment 829845 [details]
[crash-signature] Machine-readable crash signature
Attachment #758762 - Attachment is obsolete: true
(Assignee)

Updated

4 years ago
Assignee: general → nobody
As far as I can tell this code is gone.
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → INVALID
(Reporter)

Updated

2 years ago
Resolution: INVALID → WORKSFORME
You need to log in before you can comment on or make changes to this bug.