(jit) Assertion failure: obj->type()->unknownProperties() || TrackPropertyTypes(cx, obj, id), at jsinferinlines.h:440 with OOM

VERIFIED FIXED in mozilla29

Status

()

Core
JavaScript Engine: JIT
--
critical
VERIFIED FIXED
4 years ago
3 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
mozilla29
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update,testComment=8])

Attachments

(2 attachments)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision 7823e2985daf (run with --ion-eager):


oomAfterAllocations(043);
var s = new Set;
This is almost certainly bug 929065: the test is basically the same. Could you see if the patch there fixes this as well?
Depends on: 929065
Flags: needinfo?(choller)
(Reporter)

Updated

4 years ago
Flags: needinfo?(choller)
Whiteboard: [jsbugmon:update]
(Reporter)

Comment 2

4 years ago
Created attachment 822306 [details]
[crash-signature] Machine-readable crash signature
(Assignee)

Comment 3

4 years ago
decoder, this looks like some other OOM issues you fixed recently? Or is this still a problem?
Flags: needinfo?(choller)
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Comment 4

4 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision edac8cba9f78).
(Reporter)

Updated

4 years ago
Flags: needinfo?(choller)
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 5

4 years ago
JSBugMon: Fix Bisection requested, failed due to error (try manually).
(Reporter)

Comment 6

4 years ago
Updated autoBisect, let's see if it works now.
Whiteboard: [jsbugmon:] → [jsbugmon:bisectfix]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 7

4 years ago
JSBugMon: Fix Bisection requested, result:
Due to skipped revisions, the first good revision could be any of:
changeset:   http://hg.mozilla.org/mozilla-central/rev/b0678affef03
user:        Ehsan Akhgari
date:        Fri Dec 06 08:08:52 2013 -0500
summary:     Bug 915735 - Build ICU as a shared library where JS is built as a shared library; r=glandium

changeset:   http://hg.mozilla.org/mozilla-central/rev/be257c6d6d24
user:        Andrew Halberstadt
date:        Fri Dec 06 09:24:09 2013 -0500
summary:     Bug 942275 - Add support for setuptools' entry points to mach, r=gps

changeset:   http://hg.mozilla.org/mozilla-central/rev/070043d0e2e1
user:        Stephen Pohl
date:        Fri Dec 06 09:41:09 2013 -0500
summary:     Backout 2ea21428f70c (bug 860493) while working on overall performance and bugs for swipe animations. r=me

changeset:   http://hg.mozilla.org/mozilla-central/rev/40718eca5ea7
user:        Carsten "Tomcat" Book
date:        Fri Dec 06 15:58:22 2013 +0100
summary:     Backed out changeset bbd9375c5f50 (bug 938772) mochitest 5 timeout failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/6a4ad5ae7eb7
user:        Gregory Szorc
date:        Fri Dec 06 11:35:52 2013 +0800
summary:     Bug 945577 - mach rbt command to run ReviewBoard Tools; r=ahal

changeset:   http://hg.mozilla.org/mozilla-central/rev/9ff7f259d9bc
user:        Ethan Tseng
date:        Tue Nov 26 17:25:40 2013 +0800
summary:     Bug 938512 - HTMLMediaElement does not fire loadedmetadata. r=sworkman

changeset:   http://hg.mozilla.org/mozilla-central/rev/c149ae799213
user:        David Major
date:        Fri Dec 06 10:21:16 2013 -0500
summary:     Bug 939043 - Downgrade the user32 assertion to a warning message. r=bsmedberg

changeset:   http://hg.mozilla.org/mozilla-central/rev/906f5a720000
user:        Jim Chen
date:        Fri Dec 06 10:22:18 2013 -0500
summary:     Bug 942470 - Don't apply user agent update if updates have been disabled. r=fabrice

changeset:   http://hg.mozilla.org/mozilla-central/rev/013d080dbc29
user:        Dan Glastonbury
date:        Fri Dec 06 10:23:16 2013 -0500
summary:     Bug 942507 - GLContext doesn't need to have userdata. r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/b76e788fa217
user:        Walter Meinl
date:        Fri Dec 06 10:24:01 2013 -0500
summary:     Bug 946878 - Don't pass unknown options over to jemalloc configure. r=glandium

changeset:   http://hg.mozilla.org/mozilla-central/rev/0cfd889611f8
user:        Nicolas Silva
date:        Fri Dec 06 16:30:50 2013 +0100
summary:     Bug 943392 - Let MemoryTextureClient use a fallible allocation. r=BenWa

changeset:   http://hg.mozilla.org/mozilla-central/rev/11e0720cbd28
user:        Birunthan Mohanathas
date:        Fri Dec 06 10:34:20 2013 -0500
summary:     Bug 206659 - Disregard case of MIME types in nsPluginTag::InitMime and add tests to verify mixed-case MIME type handling. r=bsmedberg

changeset:   http://hg.mozilla.org/mozilla-central/rev/22b9018bf95c
user:        Byron Campen [:bwc]
date:        Mon Nov 25 10:37:21 2013 -0800
summary:     Bug 942940 - Fix bug where a destroyed peerreflexive candidate could be left in the component list if candidate pair creation/insertion failed for some reason. r=abr

changeset:   http://hg.mozilla.org/mozilla-central/rev/5544b1b9b81e
user:        Byron Campen [:bwc]
date:        Tue Dec 03 16:11:29 2013 -0800
summary:     Bug 942940 - Fix a potential memory leak. r=abr

changeset:   http://hg.mozilla.org/mozilla-central/rev/0d405a9b2a8a
user:        Dan Glastonbury
date:        Fri Dec 06 10:36:13 2013 -0500
summary:     Bug 945023 - Extract CreateTextureXXX and CreateRenderbufferXXX from GLContext. r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/815cd189ae2c
user:        Andy Wingo
date:        Wed Dec 04 14:53:25 2013 +0100
summary:     Bug 945813 - Paper over cycle collection problem in IndexedDB. r=mccr8, r=khuey

changeset:   http://hg.mozilla.org/mozilla-central/rev/5880bbf6182c
user:        Andrea Marchesini
date:        Fri Dec 06 16:40:49 2013 +0000
summary:     Bug 947134 - Enable datastore/tests/test_certifiedApp.html for B2G Emulator, r=ehsan

changeset:   http://hg.mozilla.org/mozilla-central/rev/f4f8faa3771c
user:        Jan Gerber
date:        Fri Dec 06 03:19:00 2013 -0800
summary:     Bug 918550 - Update libvpx to 1.3.0 r=glandium,cpearce

changeset:   http://hg.mozilla.org/mozilla-central/rev/e070e04b0795
user:        Jan Gerber
date:        Tue Dec 03 16:21:00 2013 -0800
summary:     Bug 833023 - Enable VP9 playback in HTML media elements. r=kinetik

changeset:   http://hg.mozilla.org/mozilla-central/rev/79d1a5a93b64
parent:      159184:e070e04b0795
parent:      159215:b746f594a884
user:        Ryan VanderMeulen
date:        Fri Dec 06 15:56:46 2013 -0500
summary:     Merge b2g-inbound to m-c.

changeset:   http://hg.mozilla.org/mozilla-central/rev/b3806ae5399d
parent:      159216:79d1a5a93b64
parent:      159246:7bda9296f32b
user:        Ryan VanderMeulen
date:        Fri Dec 06 16:03:56 2013 -0500
summary:     Merge fx-team to m-c.

changeset:   http://hg.mozilla.org/mozilla-central/rev/5aecc00ca4dd
parent:      159251:c1c2a5695550
parent:      159247:b3806ae5399d
user:        Ryan VanderMeulen
date:        Fri Dec 06 16:12:01 2013 -0500
summary:     Merge m-c to b-i.

changeset:   http://hg.mozilla.org/mozilla-central/rev/bcdcc7f548bf
user:        Anshul Jain
date:        Fri Dec 06 12:01:30 2013 -0800
summary:     Bug 946942 - Update APN settings on start if MMS call is already connected. r=gene

changeset:   http://hg.mozilla.org/mozilla-central/rev/fa482552d1aa
parent:      159184:e070e04b0795
user:        Christian Holler
date:        Fri Dec 06 18:39:42 2013 +0100
summary:     Bug 937083 - Make js::CharsToNumber propagate OOM. r=shu

changeset:   http://hg.mozilla.org/mozilla-central/rev/9d99e9ca7b32
user:        Andy Wingo
date:        Fri Dec 06 17:56:20 2013 +0100
summary:     Bug 927782 - Part 1: Expose JSScript::getBlockScope(jsbytecode *). r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/c8304ccf88e9
user:        Andy Wingo
date:        Mon Nov 25 12:19:38 2013 +0100
summary:     Bug 927782 - Part 2: Remove HAS_BLOCKCHAIN. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/fc7a979712fc
user:        Andy Wingo
date:        Mon Nov 25 12:19:58 2013 +0100
summary:     Bug 927782 - Part 3: Add DEBUGLEAVEBLOCK opcode to invalidate live DebugScopes. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/cbdd50c96b85
user:        Andy Wingo
date:        Fri Dec 06 18:22:06 2013 +0100
summary:     Bug 927782 - Part 4: Generators allocate all locals on the scope chain. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/d6946bd743b3
user:        Andy Wingo
date:        Tue Nov 26 10:11:06 2013 +0100
summary:     Bug 927782 - Part 5: Clean up bytecode generation for catch clauses. r=jorendorff

changeset:   http://hg.mozilla.org/mozilla-central/rev/f1237f11edcd
user:        Andy Wingo
date:        Tue Nov 26 10:13:59 2013 +0100
summary:     Bug 927782 - Part 6: Fix for-let nesting so nonlocal exits are easier. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/8c74b1f68590
user:        Andy Wingo
date:        Fri Dec 06 18:25:55 2013 +0100
summary:     Bug 927782 - Part 7: Refactor entering and leaving block scopes in BytecodeEmitter. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/5f086f95b305
user:        Andy Wingo
date:        Fri Dec 06 18:27:55 2013 +0100
summary:     Bug 927782 - Part 8: Record block scope ranges more precisely. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/b971de7edfff
user:        Andy Wingo
date:        Fri Dec 06 18:30:05 2013 +0100
summary:     Bug 927782 - Part 9: Fix js_DumpScriptDepth to not abort on unreachable bytecodes. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/eed9795fa80e
user:        Andy Wingo
date:        Fri Dec 06 18:42:08 2013 +0100
summary:     Bug 927782 - Part 10: Iterate block chain from compile-time block scope maps, not runtime blockChain. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/51d6617835d1
user:        Andy Wingo
date:        Tue Nov 26 12:07:02 2013 +0100
summary:     Bug 927782 - Part 11: Optimize block scopes without aliased locals. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/f86d2d4cfadf
user:        Andy Wingo
date:        Tue Nov 26 12:17:08 2013 +0100
summary:     Bug 927782 - Part 12: Remove blockChain from StackFrame. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/4dcb040e3c84
user:        Andrew McCreight
date:        Fri Dec 06 10:17:19 2013 -0800
summary:     Bug 937766, part 1 - Remove dying nodes from gCCBlackMarkedNodes. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/b015eac4566f
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 2 - Make SnowWhiteKiller remove dying things from the CC graph. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/9a4f57330003
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 3 - Add mParticipant null checks. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/abc785d60d75
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 4 - Add GCGraph::IsEmpty method. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/edb01fe9d000
user:        Andrew McCreight
date:        Fri Dec 06 10:17:20 2013 -0800
summary:     Bug 937766, part 5 - Implement PrepareForGarbageCollection. r=smaug

changeset:   http://hg.mozilla.org/mozilla-central/rev/60e84998a0a2
user:        EKR
date:        Fri Dec 06 10:20:19 2013 -0800
summary:     Bug 906968 - Add support for TURN TCP. r=abr

changeset:   http://hg.mozilla.org/mozilla-central/rev/2f8a83944e71
user:        Jan de Mooij
date:        Fri Dec 06 19:31:57 2013 +0100
summary:     Bug 937540 part 10 - Use placement new syntax for PendingMove. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/1ba23d5502e1
user:        Jan Gerber
date:        Fri Dec 06 10:00:00 2013 -0800
summary:     Date:   Fri Dec 6 18:58:44 2013 +0100

changeset:   http://hg.mozilla.org/mozilla-central/rev/06c8949f78a0
user:        Alexander Surkov
date:        Fri Dec 06 13:47:00 2013 -0500
summary:     Bug 944396 - remove GetRelativeOffset, r=tbsaunde

changeset:   http://hg.mozilla.org/mozilla-central/rev/d701e36c7ca8
user:        Gian-Carlo Pascutto
date:        Fri Dec 06 20:34:40 2013 +0100
summary:     Bug 946865 - Move Load Adaption preference to the main thread. r=jesup

changeset:   http://hg.mozilla.org/mozilla-central/rev/1d9356c6c769
user:        Luke Wagner
date:        Fri Nov 22 15:45:18 2013 -0600
summary:     Bug 931864 - remove the activeGCInAtomsZone limitation in JS::CanCompileOffThread (r=billm)

changeset:   http://hg.mozilla.org/mozilla-central/rev/b183f613840c
user:        Chris Peterson
date:        Fri Dec 06 09:47:28 2013 -0800
summary:     Bug 945613 - Part 3: #ifdef pragma for gcc >= 4.7.0. r=ehsan

changeset:   http://hg.mozilla.org/mozilla-central/rev/bf2019278b77
user:        Bobby Holley
date:        Fri Dec 06 12:01:41 2013 -0800
summary:     Bug 937317 - Make TabChildGlobal implement nsIGlobalObject. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/1c03be82647e
user:        Bobby Holley
date:        Fri Dec 06 12:01:41 2013 -0800
summary:     Bug 937317 - Factor out the shareable parts of CallSetup into AutoEntryScript and AutoIncubentScript. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/c95c51d24d1c
user:        Bobby Holley
date:        Fri Dec 06 12:01:41 2013 -0800
summary:     Bug 937317 - Implement basic script settings stack machinery. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/82df7174496c
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Manipulate the script settings stack from the RAII classes. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/a6b672cbd54d
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Implement and expose GetIncumbentGlobal. r=bz,luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/c5940c217bd9
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Pass the entire CallbackObject to CallSetup. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/7be223bdc61a
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - When invoking a callback object, restore the incumbent script settings object from when the callback was created. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/d8a07b335193
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Return null from ToWebIDLCallback if one doesn't already exist. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/6c504f06a0fb
user:        Bobby Holley
date:        Fri Dec 06 12:01:42 2013 -0800
summary:     Bug 937317 - Replace all instance of null cx pushing with AutoSystemCaller. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/97e479dec2cf
user:        Bobby Holley
date:        Fri Dec 06 12:01:43 2013 -0800
summary:     Bug 937317 - Remove unnecessary AutoSystemCaller usage. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/35371620801a
user:        Bobby Holley
date:        Fri Dec 06 12:01:43 2013 -0800
summary:     Bug 937317 - Tests. r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/e38e402fa80c
user:        Bobby Holley
date:        Fri Dec 06 12:01:43 2013 -0800
summary:     Bug 937317 - touch clobber file. r=me

changeset:   http://hg.mozilla.org/mozilla-central/rev/6fd483b8cf66
user:        David Keeler
date:        Fri Dec 06 11:59:26 2013 -0800
summary:     bug 946791 - remove unused GLContextGLX::mLibType (leaving GLXLibrary::mLibType alone) r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/94cdaced90bf
user:        Ryan VanderMeulen
date:        Fri Dec 06 15:03:19 2013 -0500
summary:     Backed out 12 changesets (bug 927782) for SM rootanalysis orange.

changeset:   http://hg.mozilla.org/mozilla-central/rev/d86f10836597
user:        Jan de Mooij
date:        Fri Dec 06 21:03:27 2013 +0100
summary:     Bug 946883 - Use NSPR thread for AsmJSMachExceptionHandler on OS X, so that it works with PosixNSPR. r=luke

changeset:   http://hg.mozilla.org/mozilla-central/rev/17760eeea357
user:        Trevor Saunders
date:        Fri Dec 06 16:03:40 2013 -0500
summary:     bug 931399 - shutdown DocAccessibles in nsDocumentViewer::Destroy r=bz

changeset:   http://hg.mozilla.org/mozilla-central/rev/7229b03abd0f
parent:      159294:17760eeea357
parent:      159247:b3806ae5399d
user:        Ryan VanderMeulen
date:        Fri Dec 06 16:13:37 2013 -0500
summary:     Merge m-c to inbound.

changeset:   http://hg.mozilla.org/mozilla-central/rev/54eac2d5c039
user:        Jeff Walden
date:        Mon Dec 17 14:53:35 2012 -0500
summary:     Bug 724768 - Store the various properties of Error objects in reserved slots, and eagerly create the stack string for them.  r=bhackett for the TI bits, r=jimb otherwise

changeset:   http://hg.mozilla.org/mozilla-central/rev/479975fcd736
user:        Jeff Walden
date:        Thu Dec 05 01:56:40 2013 -0800
summary:     Bug 724768 - Set every blank class prototype as a delegate immediately after birth, so that we can properly and correctly cache the shape for new instances of that class that use that prototype.  r=bhackett

changeset:   http://hg.mozilla.org/mozilla-central/rev/3907208b88c5
user:        Douglas Crosher
date:        Fri Dec 06 16:26:35 2013 -0500
summary:     Bug 942027 - Ionmonkey ARM: Add float32 support to callWithABIPost. r=mjrosenb

changeset:   http://hg.mozilla.org/mozilla-central/rev/fac17c3d3efd
user:        Benjamin Smedberg
date:        Fri Dec 06 12:03:47 2013 -0500
summary:     Bug 767343 - Use fallible allocation in nsSupportsString::SetData because people are putting arbitrarily-large data in it, perhaps session-restore data but I'm not sure, r=froydnj

changeset:   http://hg.mozilla.org/mozilla-central/rev/16628db76c3c
user:        Mike Conley
date:        Fri Dec 06 16:37:52 2013 -0500
summary:     Bug 863872 - If we have overdue TelemetryPings, try to send them all. r=nfroyd, feedback=irving.

changeset:   http://hg.mozilla.org/mozilla-central/rev/6cc28fece8bf
user:        Daniel Holbert
date:        Fri Dec 06 13:38:49 2013 -0800
summary:     Bug 946269: Rename nsFlexContainerFrame::ComputeFlexContainerCrossSize to ComputeCrossSize. implicit-rs=mats

changeset:   http://hg.mozilla.org/mozilla-central/rev/5fda7fbcc45b
user:        Camilo Viecco
date:        Fri Dec 06 13:42:44 2013 -0800
summary:     Bug 945349 - CertVerifier should check early for bad usages. r=briansmith

changeset:   http://hg.mozilla.org/mozilla-central/rev/9d2035e2155b
user:        Benoit Girard
date:        Fri Dec 06 16:44:22 2013 -0500
summary:     Bug 904227 - Print ? if we don't have a test object. r=bjacob

changeset:   http://hg.mozilla.org/mozilla-central/rev/d441322e0ad0
user:        Benjamin Smedberg
date:        Fri Dec 06 16:59:35 2013 -0500
summary:     Bustage followup to bug 767343 in non-unified builds

changeset:   http://hg.mozilla.org/mozilla-central/rev/d8d1d24d7893
user:        Terrence Cole
date:        Fri Dec 06 13:52:13 2013 -0800
summary:     Bug 941766 - Fix an exact rooting hazard in NPAPI; r=johns

changeset:   http://hg.mozilla.org/mozilla-central/rev/1e7ec87921a5
user:        Ehsan Akhgari
date:        Fri Dec 06 17:26:56 2013 -0500
summary:     Bug 924972 - Try to increase the timeout in test_reftests_with_caret.html for emulator b2g runs

changeset:   http://hg.mozilla.org/mozilla-central/rev/53a3cde703de
user:        Brian Hackett
date:        Fri Dec 06 14:46:36 2013 -0800
summary:     Bug 936156 - Mark run once lambdas inner to other run once lambdas, allow inlining foo.call(a) calls, r=jandem.

changeset:   http://hg.mozilla.org/mozilla-central/rev/9da422e00e1c
user:        Mike Hommey
date:        Sat Dec 07 07:47:27 2013 +0900
summary:     Bug 947083 - Kill elf-dynstr-gc. r=ted

changeset:   http://hg.mozilla.org/mozilla-central/rev/723e6647e64f
user:        Mike Hommey
date:        Sat Dec 07 07:47:55 2013 +0900
summary:     Bug 947453 - Remove media/libogg/src/moz.build. r=mshal

changeset:   http://hg.mozilla.org/mozilla-central/rev/9521a7b7b881
user:        Geoff Brown
date:        Fri Dec 06 16:02:48 2013 -0700
summary:     Bug 936226 - (4) Adjust crashtest manifest for Android x86; r=dminor

changeset:   http://hg.mozilla.org/mozilla-central/rev/36bd64203d5d
user:        Geoff Brown
date:        Fri Dec 06 16:02:49 2013 -0700
summary:     Bug 945675 - Disable testMozPay on Android 2.2 for too many intermittent failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/5f6a0a22b19c
user:        Daniel Holbert
date:        Fri Dec 06 15:06:13 2013 -0800
summary:     (no bug) Drop bogus 'flex-wrap' / 'flex-direction' declarations from non-flex-container style rules, in reftest reference cases. (test-only)

changeset:   http://hg.mozilla.org/mozilla-central/rev/769e5d448b1e
user:        Wes Kocher
date:        Fri Dec 06 17:10:09 2013 -0600
summary:     Backed out changeset 16628db76c3c (bug 863872) for debug xpcshell test failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/2099f78b7dea
parent:      159253:bcdcc7f548bf
parent:      159313:769e5d448b1e
user:        Wes Kocher
date:        Fri Dec 06 20:26:03 2013 -0600
summary:     merge inbound to m-c

changeset:   http://hg.mozilla.org/mozilla-central/rev/f9e31850d15e
parent:      159247:b3806ae5399d
user:        Matt Brubeck
date:        Fri Dec 06 13:09:31 2013 -0800
summary:     Bug 946990 - Remember whether Metro or desktop Firefox was last used [r=bbondy]

changeset:   http://hg.mozilla.org/mozilla-central/rev/12df8614fc1d
user:        Brad Lassey
date:        Wed Nov 27 15:14:26 2013 -0500
summary:     Bug 944041 - Failure to make geckoview from m-c. r=khuey

changeset:   http://hg.mozilla.org/mozilla-central/rev/05643bb0c75e
user:        Brian Grinstead
date:        Fri Dec 06 11:34:21 2013 -0600
summary:     Bug 947257 - Splitters have a dark squary sort of thing in their center. r=paul

changeset:   http://hg.mozilla.org/mozilla-central/rev/0e7592478aa5
parent:      159314:2099f78b7dea
parent:      159317:05643bb0c75e
user:        Wes Kocher
date:        Fri Dec 06 20:45:11 2013 -0600
summary:     merge fx-team to m-c

changeset:   http://hg.mozilla.org/mozilla-central/rev/42b2a2adda8f
user:        Phil Ringnalda
date:        Fri Dec 06 19:11:11 2013 -0800
summary:     Back out 567d2bba4f97 (bug 933483) for causing bug 946726

changeset:   http://hg.mozilla.org/mozilla-central/rev/d5d23d937ffc
parent:      159313:769e5d448b1e
user:        Randell Jesup
date:        Fri Dec 06 18:43:02 2013 -0500
summary:     Bug 947429: add prefs that let us disable gum video and peerconnection video r=jib

changeset:   http://hg.mozilla.org/mozilla-central/rev/10edfe4c3208
user:        Felipe Gomes
date:        Fri Dec 06 22:02:05 2013 -0200
summary:     Bug 897061 - [e10s] Implement support for form autocomplete. r=markh

changeset:   http://hg.mozilla.org/mozilla-central/rev/86307d61bcb3
user:        Donovan Preston
date:        Fri Dec 06 16:17:50 2013 -0800
summary:     Bug 707294 -- Change some strings in the webapprt to say "application" instead of "page". r=myk

changeset:   http://hg.mozilla.org/mozilla-central/rev/61cda1f28ce4
user:        Brian Hackett
date:        Fri Dec 06 16:22:20 2013 -0800
summary:     Bug 943924 - Use default stack size for JS worker threads on Windows, r=billm.

changeset:   http://hg.mozilla.org/mozilla-central/rev/2c5a87384e5b
user:        Gregory Szorc
date:        Sat Dec 07 09:30:19 2013 +0900
summary:     Bug 945577 - Followup to mach rbt so argument parsing works as expected

changeset:   http://hg.mozilla.org/mozilla-central/rev/26fb7e60d288
user:        Geoff Brown
date:        Fri Dec 06 17:48:45 2013 -0700
summary:     Bug 945675 - Disable testMozPay (entirely) for too many failures

changeset:   http://hg.mozilla.org/mozilla-central/rev/5c34885094e4
user:        Steve Fink
date:        Fri Dec 06 17:00:48 2013 -0800
summary:     Bug 947400 - Make the analysis consider whether a virtual call can GC when all targets are known, r=bhackett

changeset:   http://hg.mozilla.org/mozilla-central/rev/a55439a67e05
user:        Steve Fink
date:        Fri Dec 06 17:11:03 2013 -0800
summary:     Bug 947400 - Comment fixup, DONTBUILD

changeset:   http://hg.mozilla.org/mozilla-central/rev/957d85b31ff3
user:        Cameron McCormack
date:        Sat Dec 07 12:25:07 2013 +1100
summary:     Bug 914072 - Have nsCSSScanner store any implied characters at EOF needed for correct serialization. r=dbaron

changeset:   http://hg.mozilla.org/mozilla-central/rev/d58ca9a622c0
user:        Nicholas D. Matsakis
date:        Mon Sep 30 10:19:09 2013 -0400
summary:     Bug 922115 - Unsized array support in Typed Objects r=sfink

changeset:   http://hg.mozilla.org/mozilla-central/rev/c996211971a8
user:        Nicholas D. Matsakis
date:        Fri Nov 01 11:10:47 2013 -0400
summary:     Bug 933760 - Track a type object for each type representation, associate with the type descriptor r=bhackett

changeset:   http://hg.mozilla.org/mozilla-central/rev/ffc6dc19cc05
user:        Drew Willcoxon
date:        Fri Dec 06 18:07:09 2013 -0800
summary:     Bug 898593 - Fix intermittent failures in test_bug413958.html and others by making SimpleTest.monitorConsole() ignore unexpected messages by default. r=ted

changeset:   http://hg.mozilla.org/mozilla-central/rev/9765cb37859d
parent:      159333:ffc6dc19cc05
parent:      159318:0e7592478aa5
user:        Wes Kocher
date:        Fri Dec 06 20:47:24 2013 -0600
summary:     merge m-c to inbound

changeset:   http://hg.mozilla.org/mozilla-central/rev/80db40e98167
user:        Shu-yu Guo
date:        Fri Dec 06 19:31:09 2013 -0800
summary:     Bug 946641 - Part 1: Clear delayed events on closed documents. (r=smaug)

changeset:   http://hg.mozilla.org/mozilla-central/rev/b7186d67c952
user:        Shu-yu Guo
date:        Fri Dec 06 19:31:09 2013 -0800
summary:     Bug 946641 - Part 2: Revert in Debugger frontend to balance event suppression/unsuppression. (r=past)

changeset:   http://hg.mozilla.org/mozilla-central/rev/5ca175317475
user:        Phil Ringnalda
date:        Fri Dec 06 19:40:44 2013 -0800
summary:     Bug 939620 - Disable browser_tabview_bug599626.js on Linux, where it fails all the time and takes out the whole run

changeset:   http://hg.mozilla.org/mozilla-central/rev/910ea4847f84
user:        Joshua Cranmer
date:        Fri Dec 06 21:23:06 2013 -0600
summary:     Bug 929200, part 1: Add MOZ_HEAP_ALLOCATOR to stack-only/non-heap analyses, r=Waldo.

changeset:   http://hg.mozilla.org/mozilla-central/rev/baf7b0f169a1
user:        Joshua Cranmer
date:        Fri Dec 06 21:21:54 2013 -0600
summary:     Bug 929200, part 2: Add MOZ_HEAP_ALLOCATOR to JSContext::new_, r=jimb.

changeset:   http://hg.mozilla.org/mozilla-central/rev/84cb9cf72c02
user:        Phil Ringnalda
date:        Fri Dec 06 19:50:54 2013 -0800
summary:     Back out d5d23d937ffc (bug 947429) on suspicion of breaking gaia-ui-test

changeset:   http://hg.mozilla.org/mozilla-central/rev/5ac63cd8d6f4
parent:      159340:84cb9cf72c02
parent:      159319:42b2a2adda8f
user:        Phil Ringnalda
date:        Fri Dec 06 21:11:17 2013 -0800
summary:     Merge m-c to m-i

changeset:   http://hg.mozilla.org/mozilla-central/rev/921be552b22f
user:        Alexander Surkov
date:        Sat Dec 07 00:40:02 2013 -0500
summary:     Bug 943482 - remove a11y support of not existing xul:menulist@droppable, r=tbsaunde

changeset:   http://hg.mozilla.org/mozilla-central/rev/33e4d9281b5d
user:        Randell Jesup
date:        Fri Dec 06 18:43:02 2013 -0500
summary:     Bug 947429: add prefs that let us disable gum video and peerconnection video r=jib

changeset:   http://hg.mozilla.org/mozilla-central/rev/77d06ee9ac48
parent:      159343:33e4d9281b5d
user:        Ehsan Akhgari
date:        Fri Dec 06 21:07:02 2013 -0500
summary:     Bug 947299 - Don't build ICU as a shared library when building JS in standalone mode; r=glandium

This iteration took 353.752 seconds to run.
(Reporter)

Comment 8

4 years ago
Still reproduces, new test (m-c rev f8fea5ea69a1):

oomAfterAllocations(40);
var s = new Set;
Blocks: 912928
Flags: needinfo?(jdemooij)
Whiteboard: [jsbugmon:] → [jsbugmon:update,testComment=8]
(Assignee)

Comment 9

4 years ago
Created attachment 8348053 [details] [diff] [review]
Patch

This fixes the assert for me.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #8348053 - Flags: review?(bhackett1024)
Flags: needinfo?(jdemooij)
Comment on attachment 8348053 [details] [diff] [review]
Patch

Review of attachment 8348053 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsinferinlines.h
@@ +442,5 @@
>              return;
>          }
> +        if (!obj->type()->unknownProperties() && !obj->type()->getProperty(cx, id)) {
> +            cx->compartment()->types.setPendingNukeTypes(cx);
> +            cx->clearPendingException();

getProperty() shouldn't leave a pending exception on the cx (though getType() can).
Attachment #8348053 - Flags: review?(bhackett1024) → review+
(Reporter)

Comment 11

4 years ago
Just debugged this problem in a different test, made the same fix, then found the patch here ^.^

Jandem, can you land your patch?
Flags: needinfo?(jdemooij)
(Assignee)

Comment 12

4 years ago
(In reply to Christian Holler (:decoder) from comment #11)
> Jandem, can you land your patch?

https://hg.mozilla.org/integration/mozilla-inbound/rev/12d4105516f8

Sorry for the delay.
Flags: needinfo?(jdemooij)
https://hg.mozilla.org/mozilla-central/rev/12d4105516f8
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
Reproduced in 2013-10-22-mozilla-central-debug/jsshell-win32.
"out of memory" error message is seen on 2014-01-26-mozilla-central-debug/jsshell-win32, win 7 x64.
Verified fixed.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.