1522284 - ARM64: Crash in ion/nursery-getter-setter.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Sean Stangl [:sstangl]]

When run on ARM64 hardware, this test fails: ion/nursery-getter-setter.js

The arguments passed are as follows:

--ion-eager --ion-offthread-compile=off --more-compartments ion/nursery-getter-setter.js
--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads ion/nursery-getter-setter.js

The crash signature is as follows:

Thread 1 "js" received signal SIGSEGV, Segmentation fault.
0x000036f793643cf8 in ?? ()
(gdb) x/8i $pc-12
   0x36f793643cec:	sub	sp, x28, #0x8
   0x36f793643cf0:	str	x16, [x28, #-8]!
   0x36f793643cf4:	ldr	x2, [x2, #48]
=> 0x36f793643cf8:	ldr	x2, [x2]
   0x36f793643cfc:	mov	sp, x28
   0x36f793643d00:	blr	x2
   0x36f793643d04:	add	x28, x28, #0x48
   0x36f793643d08:	ldr	d0, [x28]
(gdb) p/x $x2
$1 = 0xfffe2f2f2f2f2f2f

Comment 1

[Chris Peterson [:cpeterson]]

[arm64:m3] because we should fix reproducible test crashes before letting ARM64 Fennec Nightly ride the trains to Beta.

Comment 2

[Nicolas B. Pierron [:nbp]]

Attachment: Bug 1522284 - ARM64: record when JitCode is storing nursery pointers.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/611a26ed535b
ARM64: record when JitCode is storing nursery pointers. r=sstangl

Comment 4

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/611a26ed535b