Closed Bug 914598 Opened 11 years ago Closed 11 years ago

Crash [@ js::jit::ICFallbackStub::addNewStub] with OOM

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 948233

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, Whiteboard: [jsbugmon:])

Crash Data

Attachments

(1 file)

The following testcase crashes on mozilla-central revision c7cc85e13f7a (run with --fuzzing-safe --ion-eager): function test() { oomAfterAllocations(2); undefined <= 3; } test();
Blocks: 912928, 872823
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/4370f503d69f user: Brian Hackett date: Thu May 23 13:25:19 2013 -0600 summary: Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem. This iteration took 1.649 seconds to run.
Flags: needinfo?(bhackett1024)
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 3ea3d3baa67b).
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/908680cb2773 parent: 159651:80d1a749ea68 user: Christian Holler date: Tue Dec 10 12:24:06 2013 +0100 summary: Bug 948233 - Fix an OOM issue in DoCompareFallback. r=jandem This iteration took 345.454 seconds to run.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: