OdinMonkey: in asm.js mode, spewing crashes the shell

RESOLVED DUPLICATE of bug 871242

Status

()

Core
JavaScript Engine
RESOLVED DUPLICATE of bug 871242
5 years ago
5 years ago

People

(Reporter: bbouvier, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
Using the shell, when log informations are asked and a asm.js script is launched, the shell will segfault. This is unfortunate as we can't use the log information and therefore run IonGraph on them.

$ IONFLAGS=regalloc ./js ~/AsmJSscript.js
> Segmentation fault (core dumped)

$ IONFLAGS=logs ./js ~/AsmJSscript.js
> Segmentation fault (core dumped)

The reason is that there is no JSContext when creating an IonContext, in AsmJS.cpp:CheckFunctionBodiesSequential. The JSContext is getting used for a memory allocation when initializing the Sprinter.

Any quick ideas about this:
- Make Sprinter use the LifoAlloc instead of the JSContext to allocate memory.
- Create the IonContext with m.cx() instead of m.cx()->compartment (side effects expected).
This looks like a duplicate of Bug 871242 and there is a patch there that may allow you to continue work.
(Reporter)

Comment 2

5 years ago
You are right, I didn't see Bug 871242 when I looked for eventual duplicates. Thanks!
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 871242
You need to log in before you can comment on or make changes to this bug.