877459 - YARR Crash [@ ~Vector] with OOM

Status: RESOLVED DUPLICATE of bug 990096

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8d85de779506 (no options required):


oomAfterAllocations(10);
actual = /\ca/.test( "\\ca" );
actual = /\c[a/]/.test( "\x1ba/]" );

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yarr bugs may have to be reported upstream, see bug 808478.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Still occurs with 64-bit debug threadsafe shell on Mac m-c rev 9afe2a1145bd.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, how should we move this forward?

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #4)
> Jan, how should we move this forward?

Sorry for the delay. On m-i tip the code looks like this:

        if (!impl.append(static_cast<T>(u)))
            js::CrashAtUnhandlableOOM("Yarr");

And |hg annotate| points to bug 990096, so I'll mark this as dup.