Closed
Bug 950474
Opened 10 years ago
Closed 10 years ago
Crash [@ get] due to unhandled OOM in js::RegExpCompartment::getOrCreateMatchResultTemplateObject
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla29
People
(Reporter: decoder, Assigned: decoder)
References
(Blocks 1 open bug)
Details
(Keywords: crash)
Crash Data
Attachments
(2 files)
1.10 KB,
patch
|
h4writer
:
review+
|
Details | Diff | Splinter Review |
1.02 KB,
patch
|
decoder
:
review+
|
Details | Diff | Splinter Review |
I'm seeing a crash that seems to be caused by an unhandled nullptr returned by NewDenseUnallocatedArray in js::RegExpCompartment::getOrCreateMatchResultTemplateObject: > HeapPtrObject & > RegExpCompartment::getOrCreateMatchResultTemplateObject(JSContext *cx) > { [...] > /* Create template array object */ > RootedObject templateObject(cx, NewDenseUnallocatedArray(cx, 0, nullptr, TenuredObject)); > > /* Set dummy index property */ > RootedValue index(cx, Int32Value(0)); > if (!baseops::DefineProperty(cx, templateObject, cx->names().index, index, Looks like templateObject should be checked here. Patch attached. Regressed by: commit c60befbddce89cabfab9161a267cff85bd25ad1d Author: Hannes Verschore <> Thu Dec 12 16:43:52 2013 Committer: Hannes Verschore <> Thu Dec 12 16:43:52 2013 Bug 879402 - Use template object to faster set the input and index properties on CreateRegExpMatchResult, r=bhackett
Attachment #8347749 -
Flags: review?(hv1989)
Comment 1•10 years ago
|
||
I forgot another one, looking at it again.
Attachment #8347941 -
Flags: review?(choller)
Updated•10 years ago
|
Attachment #8347749 -
Flags: review?(hv1989) → review+
Assignee | ||
Comment 2•10 years ago
|
||
Comment on attachment 8347941 [details] [diff] [review] patch2 Looks right :) So are you going to land this and I land my patch?
Attachment #8347941 -
Flags: review?(choller) → review+
Comment 3•10 years ago
|
||
Landed both in one commit ;) https://hg.mozilla.org/integration/mozilla-inbound/rev/a1c997b8c052
Comment 4•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/a1c997b8c052
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
Comment 5•10 years ago
|
||
Can we trigger this crash manually on older builds, so we can verify that the crash does not occur in latest builds?
Flags: needinfo?(choller)
Assignee | ||
Comment 6•10 years ago
|
||
For OOM bugs, it's generally not possible to verify that they are gone, even if we have a test. The test can easily not reproduce on a newer build, simply because we don't OOM in the right spot anymore. That said, I haven't seen or hit this anymore in fuzzing or OOM testing, so I'd consider this verified nevertheless :)
Flags: needinfo?(choller)
You need to log in
before you can comment on or make changes to this bug.
Description
•