Closed
Bug 1324580
Opened 8 years ago
Closed 8 years ago
Assertion failure: fallibleScope_ ([OOM] Cannot allocate a new chunk in an infallible scope.), at js/src/ds/LifoAlloc.cpp:105
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla53
| Tracking | Status | |
|---|---|---|
| firefox53 | --- | fixed |
People
(Reporter: gkw, Assigned: h4writer)
References
Details
(Keywords: assertion, bugmon, testcase, Whiteboard: [jsbugmon:update])
Attachments
(3 files, 1 obsolete file)
The following testcase crashes on mozilla-central revision 863c2b61bd27 (build with --enable-debug --enable-more-deterministic --32, run with --fuzzing-safe --ion-eager):
See attachment.
Backtrace:
0 js-dbg-32-dm-clang-darwin-863c2b61bd27 0x004df56e js::LifoAlloc::getOrCreateChunk(unsigned long) + 286 (LifoAlloc.cpp:105)
1 js-dbg-32-dm-clang-darwin-863c2b61bd27 0x0085a0fd js::LifoAlloc::allocImpl(unsigned long) + 109 (LifoAlloc.h:225)
2 js-dbg-32-dm-clang-darwin-863c2b61bd27 0x003c6e47 js::jit::TempObject::operator new(unsigned long, js::jit::TempAllocator&) + 151 (LifoAlloc.h:291)
3 js-dbg-32-dm-clang-darwin-863c2b61bd27 0x00319893 js::jit::ControlFlowGenerator::createBreakCatchBlock(js::jit::ControlFlowGenerator::DeferredEdge*, unsigned char*) + 115 (IonControlFlow.h:199)
4 js-dbg-32-dm-clang-darwin-863c2b61bd27 0x0031a8ef js::jit::ControlFlowGenerator::processSwitchEnd(js::jit::ControlFlowGenerator::DeferredEdge*, unsigned char*) + 47 (IonControlFlow.cpp:1977)
/snip
For detailed crash information, see attachment.
|
Reporter | |
Comment 1•8 years ago
|
||
|
|
Reporter | |
Comment 2•8 years ago
|
||
|
|
Reporter | |
Comment 3•8 years ago
|
||
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/3daa33144b64
user: Hannes Verschore
date: Thu Dec 08 13:53:05 2016 -1000
summary: Bug 1310155 - IonMonkey, part 1.0: Split graph creation from IonBuilder, r=jandem
Hannes, is bug 1310155 a likely regressor?
Blocks: 1310155
Flags: needinfo?(hv1989)
|
Assignee | |
Comment 4•8 years ago
|
||
Assignee: nobody → hv1989
Flags: needinfo?(hv1989)
Attachment #8820327 -
Flags: review?(nicolas.b.pierron)
|
|
Assignee | |
Comment 5•8 years ago
|
||
Attachment #8820327 -
Attachment is obsolete: true
Attachment #8820327 -
Flags: review?(nicolas.b.pierron)
Attachment #8820330 -
Flags: review?(nicolas.b.pierron)
|
||
Updated•8 years ago
|
Attachment #8820330 -
Flags: review?(nicolas.b.pierron) → review+
Pushed by hv1989@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1b5b00a0af64
IonMonkey - Fix out of memory error in IonBuilder, r=nbp
|
||
Comment 7•8 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
You need to log in
before you can comment on or make changes to this bug.
Description
•