Closed
Bug 936971
Opened 11 years ago
Closed 11 years ago
Assertion failure: !cx->isExceptionPending(), at ../jscntxtinlines.h:223 with OOM
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 947233
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
|
(deleted),
text/plain
|
Details |
The following testcase asserts on mozilla-central revision 16949049f03d (run with --fuzzing-safe):
try { evaluate("throw;", { noScriptRval : true }); } catch(exc1) {}
gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
function f(b) {
if (b) {}
}
gczeal(4);
function blah() {
for (var j = 0; j < 100; ++j) {}
}
(new Function("const x = (function () { if (1e+81){} else{x} } )"))();
|
Reporter | |
Comment 1•11 years ago
|
||
|
|
Reporter | |
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect]
|
|
Reporter | |
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
|
|
Reporter | |
Comment 2•11 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: http://hg.mozilla.org/mozilla-central/rev/fb2bf717ab24
user: Dan Gohman
date: Mon Oct 28 10:32:50 2013 -0700
summary: Bug 910782 - SpiderMonkey: Implement indirect-goto-based opcode dispatch. r=luke
This iteration took 430.123 seconds to run.
|
|
Reporter | |
Updated•11 years ago
|
|
|
Reporter | |
Comment 3•11 years ago
|
||
According to the traces I'm seeing, this is likely a duplicate of bug 947233.
Depends on: 947233
|
|
Reporter | |
Comment 4•11 years ago
|
||
Also just confirmed that my patch in bug 947233 fixes this. So closing as dup now.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•