467857 - TM: Another crash with jit.content enabled [@ nanojit::Assembler::asm_store32]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

+++ This bug was initially created as a clone of Bug #460511 +++

We crash again on this site from a deep abort right before a branch instruction.  We only check the deepAbort flag in MonitorRecording, it needs to be in RecordLoopEdge as well.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fixes

Not sure if the walkedOutOfLoop change was necessary.  It sounds impossible to deep abort in between setting that flag and hitting the next instruction.

Comment 2

[Andreas Gal :gal]

Make it an assert and r=me.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: better fix

Slightly better fix.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/984f615816de

Comment 5

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d46f3b7f626e

Comment 6

[Aakash Desai [:aakashd]]

Is there a way to verify this via blackbox testing if a testcase is not going to be added to mochitest?

Comment 7

[Andreas Gal :gal]

You can try capturing the page and adding it to the page set. Ideally make sure that without the patch we actually crash viewing the page.

Comment 8

[Aakash Desai [:aakashd]]

verified FIXED on builds:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090422 Minefield/3.6a1pre ID:20090422044118

and

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422042031