Loading js/src/jit-test/tests/debug/bug1353356.js 0 → 100644 +65 −0 Original line number Diff line number Diff line // |jit-test| allow-oom; --fuzzing-safe var lfLogBuffer = ` //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata setJitCompilerOption("ion.warmup.trigger", 4); var g = newGlobal(); g.debuggeeGlobal = this; g.eval("(" + function () { dbg = new Debugger(debuggeeGlobal); dbg.onExceptionUnwind = function (frame, exc) { var s = '!'; for (var f = frame; f; f = f.older) debuggeeGlobal.log += s; }; } + ")();"); j('Number.prototype.toSource.call([])'); //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata //corefuzz-dcd-selectmode 4 //corefuzz-dcd-endofdata } //corefuzz-dcd-endofdata //corefuzz-dcd-selectmode 5 //corefuzz-dcd-endofdata oomTest(() => i({ new : (true ), thisprops: true })); `; lfLogBuffer = lfLogBuffer.split('\n'); var lfRunTypeId = -1; var lfCodeBuffer = ""; while (true) { var line = lfLogBuffer.shift(); if (line == null) { break; } else if (line == "//corefuzz-dcd-endofdata") { loadFile(lfCodeBuffer); lfCodeBuffer = ""; loadFile(line); } else { lfCodeBuffer += line + "\n"; } } if (lfCodeBuffer) loadFile(lfCodeBuffer); function loadFile(lfVarx) { try { if (lfVarx.indexOf("//corefuzz-dcd-selectmode ") === 0) { lfRunTypeId = parseInt(lfVarx.split(" ")[1]) % 6; } else { switch (lfRunTypeId) { case 4: oomTest(function() { let m = parseModule(lfVarx); }); break; default: evaluate(lfVarx); } } } catch (lfVare) {} } js/src/vm/Stack.cpp +6 −8 Original line number Diff line number Diff line Loading @@ -1539,11 +1539,7 @@ jit::JitActivation::getRematerializedFrame(JSContext* cx, const JitFrameIterator uint8_t* top = iter.fp(); RematerializedFrameTable::AddPtr p = rematerializedFrames_->lookupForAdd(top); if (!p) { RematerializedFrameVector empty(cx); if (!rematerializedFrames_->add(p, top, Move(empty))) { ReportOutOfMemory(cx); return nullptr; } RematerializedFrameVector frames(cx); // The unit of rematerialization is an uninlined frame and its inlined // frames. Since inlined frames do not exist outside of snapshots, it Loading @@ -1558,9 +1554,11 @@ jit::JitActivation::getRematerializedFrame(JSContext* cx, const JitFrameIterator // be in the activation's compartment. AutoCompartmentUnchecked ac(cx, compartment_); if (!RematerializedFrame::RematerializeInlineFrames(cx, top, inlineIter, recover, p->value())) { if (!RematerializedFrame::RematerializeInlineFrames(cx, top, inlineIter, recover, frames)) return nullptr; if (!rematerializedFrames_->add(p, top, Move(frames))) { ReportOutOfMemory(cx); return nullptr; } Loading Loading
js/src/jit-test/tests/debug/bug1353356.js 0 → 100644 +65 −0 Original line number Diff line number Diff line // |jit-test| allow-oom; --fuzzing-safe var lfLogBuffer = ` //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata setJitCompilerOption("ion.warmup.trigger", 4); var g = newGlobal(); g.debuggeeGlobal = this; g.eval("(" + function () { dbg = new Debugger(debuggeeGlobal); dbg.onExceptionUnwind = function (frame, exc) { var s = '!'; for (var f = frame; f; f = f.older) debuggeeGlobal.log += s; }; } + ")();"); j('Number.prototype.toSource.call([])'); //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata //corefuzz-dcd-endofdata //corefuzz-dcd-selectmode 4 //corefuzz-dcd-endofdata } //corefuzz-dcd-endofdata //corefuzz-dcd-selectmode 5 //corefuzz-dcd-endofdata oomTest(() => i({ new : (true ), thisprops: true })); `; lfLogBuffer = lfLogBuffer.split('\n'); var lfRunTypeId = -1; var lfCodeBuffer = ""; while (true) { var line = lfLogBuffer.shift(); if (line == null) { break; } else if (line == "//corefuzz-dcd-endofdata") { loadFile(lfCodeBuffer); lfCodeBuffer = ""; loadFile(line); } else { lfCodeBuffer += line + "\n"; } } if (lfCodeBuffer) loadFile(lfCodeBuffer); function loadFile(lfVarx) { try { if (lfVarx.indexOf("//corefuzz-dcd-selectmode ") === 0) { lfRunTypeId = parseInt(lfVarx.split(" ")[1]) % 6; } else { switch (lfRunTypeId) { case 4: oomTest(function() { let m = parseModule(lfVarx); }); break; default: evaluate(lfVarx); } } } catch (lfVare) {} }
js/src/vm/Stack.cpp +6 −8 Original line number Diff line number Diff line Loading @@ -1539,11 +1539,7 @@ jit::JitActivation::getRematerializedFrame(JSContext* cx, const JitFrameIterator uint8_t* top = iter.fp(); RematerializedFrameTable::AddPtr p = rematerializedFrames_->lookupForAdd(top); if (!p) { RematerializedFrameVector empty(cx); if (!rematerializedFrames_->add(p, top, Move(empty))) { ReportOutOfMemory(cx); return nullptr; } RematerializedFrameVector frames(cx); // The unit of rematerialization is an uninlined frame and its inlined // frames. Since inlined frames do not exist outside of snapshots, it Loading @@ -1558,9 +1554,11 @@ jit::JitActivation::getRematerializedFrame(JSContext* cx, const JitFrameIterator // be in the activation's compartment. AutoCompartmentUnchecked ac(cx, compartment_); if (!RematerializedFrame::RematerializeInlineFrames(cx, top, inlineIter, recover, p->value())) { if (!RematerializedFrame::RematerializeInlineFrames(cx, top, inlineIter, recover, frames)) return nullptr; if (!rematerializedFrames_->add(p, top, Move(frames))) { ReportOutOfMemory(cx); return nullptr; } Loading