463281 - regex crashes on sunspider with new LIR code

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Robert Sayre]

To reproduce this, run the talos version of sunspider on mac. this is relatively easy to do:

1.) Make sure http://localhost/page_load_test/ points at SRCDIR/testing/performance/talos/page_load_test

2.) make a copy of SRCDIR/testing/performance/talos/sample.config that comments out the two graphserver URLs at the top, change the path to your firefox instance (e.g. OBJDIR/dist/Minefield.app/Contents/MacOS/firefox), and remove everything but SunSpider from the test inventory at the bottom of the file

3.) python runtests.py your.config (you may need pyyaml if you get an import error from python)

Comment 1

[Robert Sayre]

Attachment: stack

Comment 2

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/582a62c8f910

Comment 3

[Andreas Gal :gal]

This is a nanojit problem (need to clean up and separate GuardStruct and SideExit structs), not really regexp.

Comment 4

[Andreas Gal :gal]

Not fixed.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: Patch for fragmento mgmt crash

Comment 6

[Bob Clary [:bc] (inactive)]

test covered by talos sunspider.

Comment 7

[Aakash Desai [:aakashd]]

Seeing that there haven't been any duplicate sightings for this issue for 4
months, I'm going to go ahead and verify this unless someone has an issue with
that.