1508121 - Crash in js::jit::LIRGenerator::visitInstructionDispatch

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Julian Seward [:jseward]]

This bug was filed from the Socorro interface and is
report bp-2f56eb07-0c1b-4105-a0d3-296ed0181116.
=============================================================

This showed up in two different installations in the Windows
nightly of 20181115223444.

Top 10 frames of crashing thread:

0 xul.dll js::jit::LIRGenerator::visitInstructionDispatch js/src/jit/Lowering.cpp:5207
1 xul.dll js::jit::LIRGenerator::visitBlock js/src/jit/Lowering.cpp:5324
2 xul.dll js::jit::LIRGenerator::generate js/src/jit/Lowering.cpp:5398
3 xul.dll js::jit::GenerateLIR js/src/jit/Ion.cpp:1787
4 xul.dll js::jit::CompileBackEnd js/src/jit/Ion.cpp:1892
5 xul.dll js::HelperThread::handleIonWorkload js/src/vm/HelperThreads.cpp:2149
6 xul.dll js::HelperThread::threadLoop js/src/vm/HelperThreads.cpp:2597
7 xul.dll static unsigned int js::detail::ThreadTrampoline<void  js/src/threading/Thread.h:236
8 ucrtbase.dll ucrtbase.dll@0x216c1 
9 kernelbase.dll kernelbase.dll@0x64db8 

=============================================================

Comment 1

[Jan de Mooij [:jandem]]

Nothing jumps out at me, looks like random memory corruption. It isn't a topcrash so I'll add it to our crash triage list.

Comment 2

[Nicolas B. Pierron [:nbp]]

This might be a duplicate of Bug 1507084.

Comment 3

[Nicolas B. Pierron [:nbp]]

(In reply to Nicolas B. Pierron [:nbp] from comment #2)
> This might be a duplicate of Bug 1507084.

As opposed to these other bugs, there is a suspicious list of addresses which have the following bit patterns:

 	0x10xxxxxx

It might be worth looking into anything which is manipulating flags, and if these could be miss-interpreted.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.