936971 - Assertion failure: !cx->isExceptionPending(), at ../jscntxtinlines.h:223 with OOM

Status: RESOLVED DUPLICATE of bug 947233

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 16949049f03d (run with --fuzzing-safe):


try { evaluate("throw;", { noScriptRval : true }); } catch(exc1) {}
gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
function f(b) {
    if (b) {}
}
gczeal(4);
function blah() {
  for (var j = 0; j < 100; ++j) {}
}
(new Function("const x = (function () { if (1e+81){} else{x} } )"))();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/fb2bf717ab24
user:        Dan Gohman
date:        Mon Oct 28 10:32:50 2013 -0700
summary:     Bug 910782 - SpiderMonkey: Implement indirect-goto-based opcode dispatch. r=luke

This iteration took 430.123 seconds to run.

Comment 3

[Christian Holler (:decoder)]

According to the traces I'm seeing, this is likely a duplicate of bug 947233.

Comment 4

[Christian Holler (:decoder)]

Also just confirmed that my patch in bug 947233 fixes this. So closing as dup now.