1046164 - IonMonkey MIPS: Test ion/bug883490.js crashes on MIPS

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Branislav Rankov [:rankov]]

Test ion/bug883490.js crashes on MIPS with segfault.

Comment 1

[Branislav Rankov [:rankov]]

Attachment: Restore-GlobalReg.patch

The problem here was that GlobalReg is not restored on time. The branchTestMagic [1] jumps to the code generated by GenerateThrowStub which uses GlobalReg on line [2]

[1] https://hg.mozilla.org/mozilla-central/file/08c23f12a43e/js/src/jit/AsmJS.cpp#l6376
[2] https://hg.mozilla.org/mozilla-central/file/08c23f12a43e/js/src/jit/AsmJS.cpp#l6749

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 8464756 [details] [diff] [review]
Restore-GlobalReg.patch

Review of attachment 8464756 [details] [diff] [review]:
-----------------------------------------------------------------

Good fix!  I wonder if this is a bug on ARM too...

::: js/src/jit/AsmJS.cpp
@@ +6376,5 @@
>          masm.loadPtr(Address(reg1, JitActivation::offsetOfPrevJitJSContext()), reg2);
>          masm.storePtr(reg2, Address(reg0, offsetOfJitJSContext));
>      }
>  
> +    JS_ASSERT(masm.framePushed() == framePushed);

Can you copy this assertion back to where it was originally?

Comment 3

[Branislav Rankov [:rankov]]

Attachment: Restore-GlobalReg.patch

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 8464815 [details] [diff] [review]
Restore-GlobalReg.patch

You know, I was wrong, this assertion does belong right before the loadPtrs and GenerateAsmJSExitEpilogue already asserts masm.framePushed() == framePushed, so let's land the original patch exactly as r+'d.

Comment 5

[Douglas Crosher [:dougc]]

(In reply to Luke Wagner [:luke] from comment #2)
> Comment on attachment 8464756 [details] [diff] [review]
> Restore-GlobalReg.patch
> 
> Review of attachment 8464756 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> Good fix!  I wonder if this is a bug on ARM too...

Yes, it looks like this would have affected the ARM too, but it did not show up in testing. Good to have it fixed.

Comment 6

[Branislav Rankov [:rankov]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/59f51f567be1

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/59f51f567be1