866830 - Assertion failure: !global->nativeLookup(cx, id), at ../jsobjinlines.h:1717 with OOM

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 05533d50f2f7 (run with --ion-eager):


try {
  gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
  new this;
} catch(exc0) {}
function f(o) {
  Float32Array += ''        
}
f();

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   129593:ee14945b452c
parent:      128511:d989eab66df4
user:        Brian Hackett
date:        Thu Apr 11 18:39:32 2013 -0600
summary:     Bug 804676 - Remove dependence of Ion compilation on ScriptAnalysis::analyzeTypes.

This iteration took 13.129 seconds to run.

Oops! We didn't test rev d989eab66df4, a parent of the blamed revision! Let's do that now.
Rev d989eab66df4: Found cached shell...   Testing... [Uninteresting] It didn't crash. (0.039 seconds)
good (not interesting) 
As expected, the parent's label is the opposite of the blamed rev's label.

Comment 2

[Christian Holler (:decoder)]

Brian, can you take a look? :)

Comment 3

[Brian Hackett [Laid off!]]

This doesn't have anything to do with bug 804676.  The OOMs are happening inside typed array initialization code, it looks like the class wasn't fully initialized.

Comment 4

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 5

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 6

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 9ca690835a5e).

Comment 7

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 8

[Tom S [:evilpie]]

As far as I can tell this code is gone.