Bug 171516 – 32-bit JSC test failing: stress/js-fixed-array-out-of-memory.js.default

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Ryan Haddad]

32-bit JSC test failing: stress/js-fixed-array-out-of-memory.js.default

stress/js-fixed-array-out-of-memory.js.default: 1   0x128ab8a WTFCrash
stress/js-fixed-array-out-of-memory.js.default: 2   0x30d20b WTF::CrashOnOverflow::crash()
stress/js-fixed-array-out-of-memory.js.default: 3   0x30d1db WTF::CrashOnOverflow::overflowed()
stress/js-fixed-array-out-of-memory.js.default: 4   0x310900 WTF::Checked<unsigned long, WTF::CrashOnOverflow>::Checked<unsigned long>(unsigned long)
stress/js-fixed-array-out-of-memory.js.default: 5   0x310834 WTF::Checked<unsigned long, WTF::CrashOnOverflow>::Checked(WTF::ResultOverflowedTag)
stress/js-fixed-array-out-of-memory.js.default: 6   0x50d3fd WTF::Checked<WTF::Result<unsigned long, unsigned long>::ResultType, WTF::CrashOnOverflow> WTF::operator*<unsigned long, unsigned long, WTF::CrashOnOverflow>(WTF::Checked<unsigned long, WTF::CrashOnOverflow>, WTF::Checked<unsigned long, WTF::CrashOnOverflow>)
stress/js-fixed-array-out-of-memory.js.default: 7   0x50d1dc WTF::Checked<WTF::Result<unsigned long, unsigned long>::ResultType, WTF::CrashOnOverflow> WTF::operator*<unsigned long, unsigned long, WTF::CrashOnOverflow>(WTF::Checked<unsigned long, WTF::CrashOnOverflow>, unsigned long)
stress/js-fixed-array-out-of-memory.js.default: 8   0x5132ab JSC::JSFixedArray::allocationSize(WTF::Checked<unsigned long, WTF::CrashOnOverflow>)
stress/js-fixed-array-out-of-memory.js.default: 9   0x513062 JSC::JSFixedArray::tryCreate(JSC::VM&, JSC::Structure*, unsigned int)
stress/js-fixed-array-out-of-memory.js.default: 10  0x50c56e JSC::JSFixedArray::createFromArray(JSC::ExecState*, JSC::VM&, JSC::JSArray*)
stress/js-fixed-array-out-of-memory.js.default: 11  0x50bfd3 slow_path_spread
stress/js-fixed-array-out-of-memory.js.default: 12  0xeb2274 llint_entry
stress/js-fixed-array-out-of-memory.js.default: 13  0xeb308a llint_entry
stress/js-fixed-array-out-of-memory.js.default: 14  0xead94c vmEntryToJavaScript
stress/js-fixed-array-out-of-memory.js.default: 15  0xc75078 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/js-fixed-array-out-of-memory.js.default: 16  0xc19ba2 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
stress/js-fixed-array-out-of-memory.js.default: 17  0x514d65 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/js-fixed-array-out-of-memory.js.default: 18  0xd2983 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow, 16ul> const&, WTF::String const&, bool, bool, bool)
stress/js-fixed-array-out-of-memory.js.default: 19  0x8e247 jscmain(int, char**)::$_7::operator()(JSC::VM&, GlobalObject*) const
stress/js-fixed-array-out-of-memory.js.default: 20  0x7dedf int runJSC<jscmain(int, char**)::$_7>(CommandLine, jscmain(int, char**)::$_7 const&)
stress/js-fixed-array-out-of-memory.js.default: 21  0x7c85e jscmain(int, char**)
stress/js-fixed-array-out-of-memory.js.default: 22  0x7c797 main
stress/js-fixed-array-out-of-memory.js.default: 23  0xa1692395 start
stress/js-fixed-array-out-of-memory.js.default: test_script_4864: line 2: 30673 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --maxPerThreadStackUsage\=1572864 --useFTLJIT\=true --maxSingleAllocationSize\=1048576 js-fixed-array-out-of-memory.js )
stress/js-fixed-array-out-of-memory.js.default: ERROR: Unexpected exit code: 139
FAIL: stress/js-fixed-array-out-of-memory.js.default

https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/486

[Mark Lam]

Created attachment 308830 [details]
proposed patch.

[Geoffrey Garen]

Comment on attachment 308830 [details]
proposed patch.

r=me

[Mark Lam]

Thanks for the review.  Landed in r216076: <http://trac.webkit.org/r216076>.