1844696 - Crash in [@ BaselineStackBuilder::buildStubFrame] with MOZ_DIAGNOSTIC_ASSERT(false) (ComputeBinarySearchMid(FallbackStubs(this), pcOffset, &mid))

Status: RESOLVED DUPLICATE of bug 1843344

(Core :: JavaScript Engine: JIT, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/78e234e0-a752-4d96-b400-419450230718

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(false) (ComputeBinarySearchMid(FallbackStubs(this), pcOffset, &mid))

Top 10 frames of crashing thread:

0  libxul.so  BaselineStackBuilder::buildStubFrame  js/src/jit/BaselineBailouts.cpp
0  libxul.so  BaselineStackBuilder::prepareForNextFrame  js/src/jit/BaselineBailouts.cpp:855
0  libxul.so  BaselineStackBuilder::buildOneFrame  js/src/jit/BaselineBailouts.cpp:1453
0  libxul.so  js::jit::BailoutIonToBaseline  js/src/jit/BaselineBailouts.cpp:1590
1  libxul.so  js::jit::Bailout  js/src/jit/Bailouts.cpp:144
2  ?  @0x00002132885d4166  
3  ?  @0x0000213288a7319a  
4  ?  @0x00002132885d44e8  
5  libxul.so  EnterJit  js/src/jit/Jit.cpp:104
5  libxul.so  js::jit::MaybeEnterJit  js/src/jit/Jit.cpp:213

Only 2 of these crashes, but it looks like it is possibly new and has a diagnostic assert so I figured I'd file it. I'm not sure where this is actually happening.

Comment 1

[André Bargull [:anba]]

This looks similar to bug 1843344.

Comment 2

[Iain Ireland [:iain]]

Unfortunately, like bug 1843344, the minidump only shows the out-of-line code where we jumped after failing the assertion, so we get little to no information about what was happening before that.

Duping this to that bug.