Crash [@ js::jit::ICFallbackStub::addNewStub] with OOM

RESOLVED DUPLICATE of bug 948233

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 948233
4 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Trunk
x86
Linux
crash, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
The following testcase crashes on mozilla-central revision c7cc85e13f7a (run with --fuzzing-safe --ion-eager):


function test() {
oomAfterAllocations(2);
undefined <= 3;
} test();
(Reporter)

Updated

4 years ago
Blocks: 912928, 872823
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Comment 1

4 years ago
Created attachment 802264 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 2

4 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/4370f503d69f
user:        Brian Hackett
date:        Thu May 23 13:25:19 2013 -0600
summary:     Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem.

This iteration took 1.649 seconds to run.
Flags: needinfo?(bhackett1024)
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Comment 3

4 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 3ea3d3baa67b).
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 4

4 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/908680cb2773
parent:      159651:80d1a749ea68
user:        Christian Holler
date:        Tue Dec 10 12:24:06 2013 +0100
summary:     Bug 948233 - Fix an OOM issue in DoCompareFallback. r=jandem

This iteration took 345.454 seconds to run.
(Reporter)

Updated

4 years ago
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → DUPLICATE
Duplicate of bug: 948233
You need to log in before you can comment on or make changes to this bug.