Closed Bug 1522284 Opened 8 months ago Closed 8 months ago

ARM64: Crash in ion/nursery-getter-setter.js

Categories

(Core :: JavaScript Engine: JIT, defect, P2)

ARM64
Unspecified
defect

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox-esr60 --- wontfix
firefox64 --- wontfix
firefox65 --- wontfix
firefox66 --- wontfix
firefox67 --- fixed

People

(Reporter: sstangl, Assigned: nbp)

References

(Blocks 1 open bug)

Details

(Keywords: crash, Whiteboard: [arm64:m3])

Attachments

(1 file)

When run on ARM64 hardware, this test fails: ion/nursery-getter-setter.js

The arguments passed are as follows:

--ion-eager --ion-offthread-compile=off --more-compartments ion/nursery-getter-setter.js
--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads ion/nursery-getter-setter.js

The crash signature is as follows:

Thread 1 "js" received signal SIGSEGV, Segmentation fault.
0x000036f793643cf8 in ?? ()
(gdb) x/8i $pc-12
   0x36f793643cec:	sub	sp, x28, #0x8
   0x36f793643cf0:	str	x16, [x28, #-8]!
   0x36f793643cf4:	ldr	x2, [x2, #48]
=> 0x36f793643cf8:	ldr	x2, [x2]
   0x36f793643cfc:	mov	sp, x28
   0x36f793643d00:	blr	x2
   0x36f793643d04:	add	x28, x28, #0x48
   0x36f793643d08:	ldr	d0, [x28]
(gdb) p/x $x2
$1 = 0xfffe2f2f2f2f2f2f

[arm64:m3] because we should fix reproducible test crashes before letting ARM64 Fennec Nightly ride the trains to Beta.

Keywords: crash
Whiteboard: [arm64:m3]
Assignee: nobody → nicolas.b.pierron
Status: NEW → ASSIGNED
Pushed by npierron@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/611a26ed535b
ARM64: record when JitCode is storing nursery pointers. r=sstangl
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.