Closed
Bug 1004744
Opened 11 years ago
Closed 9 years ago
Assertion failure: stack_[i].pc() != nullptr
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: djvj, Unassigned)
Details
(Keywords: sec-moderate)
Ran into this while testing a patch, but the bug exists in the codebase currently.
Running the following crashes:
js --ion-eager -e 'enableSPSProfilingWithSlowAssertions()' js/src/jit-test/tests/basic/bug908915.js
GDB stack at location:
(gdb) bt 10
#0 0x0000000000ab1008 in js::SPSProfiler::enter (this=0x1b1c6a0, script=0x7ffff5946380,
maybeFun=0x7ffff5993c80)
at /home/kvijayan/Checkouts/mozilla-inbound/js/src/vm/SPSProfiler.cpp:165
#1 0x000000000061b6e5 in js::jit::DoProfilerFallback (cx=0x1b30dd0, frame=0x7fffffffc410,
stub=0x1c17db0) at /home/kvijayan/Checkouts/mozilla-inbound/js/src/jit/BaselineIC.cpp:1074
#2 0x00007ffff7f7f8f3 in ?? ()
#3 0xfffbfffff5993280 in ?? ()
#4 0x00007fffffffc3e0 in ?? ()
#5 0x0000000001af59c0 in js::jit::DoUseCountFallbackInfo ()
#6 0x00007ffff5b352b0 in ?? ()
#7 0x00007ffff7fb3726 in ?? ()
#8 0x0000000000000581 in ?? ()
#9 0x00007fffffffc410 in ?? ()
(More stack frames follow...)
|
||
Updated•11 years ago
|
Keywords: sec-moderate
|
|
||
Updated•11 years ago
|
Group: core-security
|
|
||
Updated•11 years ago
|
Group: javascript-core-security
|
||
Updated•10 years ago
|
Group: core-security → javascript-core-security
|
||
Comment 1•9 years ago
|
||
I was not able to reproduce this issue.
I ran the full test suite with "-e 'enableSPSProfilingWithSlowAssertions()'" without any similar crashes.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
|
|
||
Updated•8 years ago
|
Group: javascript-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•