1502611 - Crash in js::jit::BaselineScript::retAddrEntryFromReturnAddress

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-13f1153c-b042-45db-94a4-ad9b80181027.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll js::jit::BaselineScript::retAddrEntryFromReturnAddress js/src/jit/BaselineJIT.cpp:811
1 xul.dll js::jit::JSJitFrameIter::baselineScriptAndPc js/src/jit/JSJitFrameIter.cpp:152
2 xul.dll js::FrameIter::settleOnActivation js/src/vm/Stack.cpp:774
3 xul.dll js::FrameIter::FrameIter js/src/vm/Stack.cpp:832
4 xul.dll js::SavedStacks::insertFrames js/src/vm/SavedStacks.cpp:1430
5 xul.dll js::SavedStacks::saveCurrentStack js/src/vm/SavedStacks.cpp:1289
6 xul.dll JS::CaptureCurrentStack js/src/jsapi.cpp:7169
7 xul.dll PromiseDebugInfo::create js/src/builtin/Promise.cpp:295
8 xul.dll static class js::PromiseObject* CreatePromiseObjectWithoutResolutionFunctions js/src/builtin/Promise.cpp:1163
9 xul.dll js::CreatePromiseObjectForAsync js/src/builtin/Promise.cpp:3429

=============================================================

There are 2 crashes (from 2 installations) in nightly 65 with buildid 20181026100128. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1499649.

[1] https://hg.mozilla.org/mozilla-central/rev?node=daf8a3b98eee

Comment 1

[Ted Campbell [:tcampbell]]

The crashes are both on a compare instruction (impossible), but it is curious they crash on the same one. The memory in dump at near crash matches the shipping binary so it doesn't seem anti-virus related.

Both crashes are using Ryzen processors with GTX 1050/1060 Ti video cards so I am strongly leaning to home-built machines with overclocking or bad RAM. In the past when I've investigated weird Ryzen crashes, everyone who responded to me confirmed bad hardware (thermal or RAM) and their problems went away when the fixed the part.

Comment 2

[Jan de Mooij [:jandem]]

Ted, thanks for looking at this.

FWIW, if we see more crashes with a similar signature, it's also possible it's just a signature change from renaming icEntryFrom* to retAddrEntryFrom*.