1258432 - spike in crashes with signature [@ EnterIon] and [@ js::jit::EnterBaselineMethod] starting in nightly 2016-03-20

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This bug was filed from the Socorro interface and is 
report bp-426a104d-59ac-47c9-bb1d-76ba72160320.
=============================================================

There's been a spike in crashes with signature EnterIon starting in nightly 2016-03-20.

The new crashes are all EXCEPTION_ACCESS_VIOLATION_READ, with 0x18 crash address on amd64 and 0x10 crash address on x86.

A query for EnterIon crashes on nightly builds on Windows since March 1 is:
https://crash-stats.mozilla.com/signature/?product=Firefox&release_channel=nightly&platform=Windows&date=%3E%3D2016-03-01&signature=EnterIon&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=cpu_arch&page=1#aggregations
If you look at the aggregations tab and sort by build ID, you will see a very clear spike (probably at least a factor of 100 higher).

The regression range between those 2 nightlies is:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9c5d494d0548&tochange=f14898695ee0

Comment 1

[Jan de Mooij [:jandem]]

This should be fixed by bug 1258320.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Also similar spike in crashes in js::jit::EnterBaselineMethod :
https://crash-stats.mozilla.com/signature/?product=Firefox&release_channel=nightly&platform=Windows&date=%3E%3D2016-03-01&signature=js%3A%3Ajit%3A%3AEnterBaselineMethod#aggregations

Comment 3

[Nicolas B. Pierron [:nbp]]

(In reply to David Baron [:dbaron] ⌚️UTC-4 (less responsive until April 4) from comment #2)
> Also similar spike in crashes in js::jit::EnterBaselineMethod

EnterBaseline can also jump into Ion generated code, as Baseline compiled function can call Ion compiled functions, or because we OSR from baseline into Ion.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to Jan de Mooij [:jandem] from comment #1)
> This should be fixed by bug 1258320.

It was fixed.

Comment 5

[Marcia Knous [:marcia]]

Tracking 48+.