1842035 - Crash in [@ js::jit::CacheRegisterAllocator::addressOf]

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect)

Description

[Chris Peterson [:cpeterson]]

This JIT crashes first appeared in 115. All of the crashes are on Android (except for a shutdown hang in CacheRegisterAllocator::addressOf on desktop that's probably unrelated: bp-319bb278-3c43-408b-8f13-e610d0230615).

Crash report: https://crash-stats.mozilla.org/report/index/0a931803-e166-4282-b872-f2dfb0230702

Reason: SIGSEGV / SEGV_MAPERR

Top 2 frames of crashing thread:

0  libxul.so  js::jit::CacheRegisterAllocator::addressOf const  js/src/jit/BaselineCacheIRCompiler.cpp:50
0  libxul.so  js::jit::BaselineCacheIRCompiler::updateArgc  js/src/jit/BaselineCacheIRCompiler.cpp:2586

Comment 1

[Chris Peterson [:cpeterson]]

All 256 of the crash reports we've received so far are from one user, so they might just have some bad hardware.

Comment 2

[Iain Ireland [:iain]]

There is nothing in CacheRegisterAllocator::addressOf that could reasonably crash. It's not dereferencing any pointers; it's just doing some math. I can't get breakpad to give me arm disassembly, but since every crash was from the same user, it seems very likely that their binary was corrupted somehow.

Nothing we can do here.