Closed
Bug 1437499
Opened 7 years ago
Closed 7 years ago
Crash [@ ??] or Assertion failure: frame.exitFrame()->isWrapperExit(), at jit/JitFrames.cpp:1158 with wasm and Debugger
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla60
Tracking | Status | |
---|---|---|
firefox-esr52 | --- | unaffected |
firefox58 | --- | unaffected |
firefox59 | --- | unaffected |
firefox60 | --- | fixed |
People
(Reporter: decoder, Assigned: bbouvier)
References
Details
(5 keywords, Whiteboard: [fuzzblocker] [jsbugmon:update])
Crash Data
Attachments
(2 files, 1 obsolete file)
2.09 KB,
text/plain
|
Details | |
8.08 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
The following testcase crashes on mozilla-central revision 2b7d42d527af (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe):
See attachment.
Backtrace:
received signal SIGSEGV, Segmentation fault.
0x00001f2e1cb42026 in ?? ()
#0 0x00001f2e1cb42026 in ?? ()
#1 0x00007fffffffc518 in ?? ()
#2 0x00007ffff4869400 in ?? ()
#3 0x00001f2e1cb420d0 in ?? ()
#4 0x00007fffffffc530 in ?? ()
#5 0x0000000000000000 in ?? ()
rax 0x1f2e1cb42320 34282910524192
rbx 0x7ffff4852fe0 140737295757280
rcx 0x7ffff49f5740 140737297471296
rdx 0x1f2e1cb42000 34282910523392
rsi 0xffffffffffff8000 -32768
rdi 0xffef 65519
rbp 0x7fffffffc4f8 140737488340216
rsp 0x7fffffffc4f8 140737488340216
r8 0x2 2
r9 0x3 3
r10 0x7fffffffc648 140737488340552
r11 0x7ffff4852f20 140737295757088
r12 0x7fffffffc540 140737488340288
r13 0x7ffff49f5740 140737297471296
r14 0x7ffff4869400 140737295848448
r15 0x7ffe747f0000 140730852900864
rip 0x1f2e1cb42026 34282910523430
=> 0x1f2e1cb42026: mov %si,0x10(%r15,%rdi,1)
0x1f2e1cb4202c: pop %rbp
These crashes are hard to distinguish from others, so marking as fuzzblocker.
Reporter | ||
Comment 1•7 years ago
|
||
Assignee | ||
Updated•7 years ago
|
Assignee: nobody → bbouvier
Status: NEW → ASSIGNED
Assignee | ||
Comment 2•7 years ago
|
||
Some trivial issue in binary->text that prevents us from doing a text->binary thereafter.
Attachment #8950294 -
Flags: review?(luke)
Updated•7 years ago
|
Attachment #8950294 -
Flags: review?(luke) → review+
Assignee | ||
Comment 3•7 years ago
|
||
I really meant to implement this, then did it, then decided it wasn't useful because good reasons, then we changed the design of the jit entry, then I forgot about this again.
Comes with a nice refactoring to avoid more code duplication between exit frames called from a JitFrameLayout.
Attachment #8950295 -
Flags: review?(jdemooij)
Updated•7 years ago
|
Whiteboard: [jsbugmon:update,bisect][fuzzblocker] → [fuzzblocker] [jsbugmon:update]
Comment 4•7 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/cb6130865cac
user: Benjamin Bouvier
date: Thu Feb 08 14:37:03 2018 +0100
summary: Bug 1319203: Implement the jit-to-wasm entry stub and use it; r=luke, r=jandem
This iteration took 277.031 seconds to run.
Comment 5•7 years ago
|
||
Comment on attachment 8950295 [details] [diff] [review]
2.implement-wasm-frame-exit.patch
Review of attachment 8950295 [details] [diff] [review]:
-----------------------------------------------------------------
Nice refactoring!
Attachment #8950295 -
Flags: review?(jdemooij) → review+
Pushed by bbouvier@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cdb66b98f4bc
Commonize CalledFromJitExitFrameLayout and use it for wasm too; r=jandem
Assignee | ||
Comment 7•7 years ago
|
||
Comment on attachment 8950294 [details] [diff] [review]
1.double-escape.patch
Dropped this patch because it caused issues with wasm-full-cycle and it isn't worth worrying too much about it.
Attachment #8950294 -
Attachment is obsolete: true
Comment 8•7 years ago
|
||
bugherder |
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
Updated•7 years ago
|
Blocks: 1319203
status-firefox58:
--- → unaffected
status-firefox59:
--- → unaffected
status-firefox-esr52:
--- → unaffected
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•