948233 - Improper OOM check in DoCompareFallback

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: js-setNext-oom.patch

In js::jit::DoCompareFallback we have the following code:

>    ICStub *doubleStub = compiler.getStub(compiler.getStubSpace(script));
>    if (!stub)
>        return false;

I think this is either a typo or some tasty copy-pasta. I changed stub to doubleStub and it fixed another OOM crasher for me. Jandem, can you review the attached patch since it's your code?

Comment 1

[Christian Holler (:decoder)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/908680cb2773

Comment 2

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/908680cb2773

Comment 4

[Chris Peterson [:cpeterson]]

Christian: should this OOM fix be uplifted to Aurora 28 and Beta 27?

Comment 5

[Christian Holler (:decoder)]

This one can safely be uplifted to Aurora at least.

Comment 6

[Christian Holler (:decoder)]

Comment on attachment 8345050 [details] [diff] [review]
js-setNext-oom.patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): N/A
User impact if declined: Crashes with OOM conditions
Testing completed (on m-c, etc.): A few days on mozilla-central
Risk to taking this patch (and alternatives if risky): Not risky, patch is just fixing a null check (fixing a typo).
String or IDL/UUID changes made by this patch: None

Comment 7

[Christian Holler (:decoder)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/8f29c6506b23

Comment 8

[u279076]

I don't think this needs QA verification. If anyone thinks that's a mistake please remove the [qa-] whiteboard tag and add the verifyme keyword.