Closed Bug 950474 Opened 10 years ago Closed 10 years ago

Crash [@ get] due to unhandled OOM in js::RegExpCompartment::getOrCreateMatchResultTemplateObject

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla29

People

(Reporter: decoder, Assigned: decoder)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

I'm seeing a crash that seems to be caused by an unhandled nullptr returned by NewDenseUnallocatedArray in js::RegExpCompartment::getOrCreateMatchResultTemplateObject:

> HeapPtrObject &
> RegExpCompartment::getOrCreateMatchResultTemplateObject(JSContext *cx)
> {
[...]
>    /* Create template array object */
>    RootedObject templateObject(cx, NewDenseUnallocatedArray(cx, 0, nullptr, TenuredObject));
>
>    /* Set dummy index property */
>    RootedValue index(cx, Int32Value(0));
>    if (!baseops::DefineProperty(cx, templateObject, cx->names().index, index,


Looks like templateObject should be checked here. Patch attached.

Regressed by:

commit c60befbddce89cabfab9161a267cff85bd25ad1d
Author:	Hannes Verschore <>  Thu Dec 12 16:43:52 2013
Committer:	Hannes Verschore <> Thu Dec 12 16:43:52 2013

Bug 879402 - Use template object to faster set the input and index properties on CreateRegExpMatchResult, r=bhackett
Attachment #8347749 - Flags: review?(hv1989)
Attached patch patch2Splinter Review
I forgot another one, looking at it again.
Attachment #8347941 - Flags: review?(choller)
Attachment #8347749 - Flags: review?(hv1989) → review+
Comment on attachment 8347941 [details] [diff] [review]
patch2

Looks right :) So are you going to land this and I land my patch?
Attachment #8347941 - Flags: review?(choller) → review+
https://hg.mozilla.org/mozilla-central/rev/a1c997b8c052
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
Keywords: verifyme
Can we trigger this crash manually on older builds, so we can verify that the crash does not occur in latest builds?
Flags: needinfo?(choller)
For OOM bugs, it's generally not possible to verify that they are gone, even if we have a test. The test can easily not reproduce on a newer build, simply because we don't OOM in the right spot anymore. That said, I haven't seen or hit this anymore in fuzzing or OOM testing, so I'd consider this verified nevertheless :)
Flags: needinfo?(choller)
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: