472440 - Crash [@ TraceRecorder::record_JSOP_CALLGVAR]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

js1_7/regress/regress-418641.js browser; jit only

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xfffffffc
0x00362fb7 in TraceRecorder::record_JSOP_CALLGVAR (this=0x1dc90930) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:8489
8489	    jsval& v = STOBJ_GET_SLOT(cx->fp->scopeChain, slot);
(gdb) bt
#0  0x00362fb7 in TraceRecorder::record_JSOP_CALLGVAR (this=0x1dc90930) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:8489
#1  0x00367279 in TraceRecorder::monitorRecording (this=0x1dc90930, op=JSOP_CALLGVAR) at jsopcode.tbl:545
#2  0x00293303 in js_Interpret (cx=0xacb600) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsinterp.cpp:2840
#3  0x002b8a6a in js_Execute (cx=0xacb600, chain=0x1db9d5c0, script=0xcd4200, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1564
#4  0x002487a7 in JS_EvaluateUCScriptForPrincipals (cx=0xacb600, obj=0x1db9d5c0, principals=0x1c388c84, chars=0xd03008, length=4035, filename=0x1dc08418 "http://test.mozilla.com/tests/mozilla.org/js/js1_7/regress/regress-418641.js", lineno=1, rval=0x0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsapi.cpp:5192
#5  0x13055687 in nsJSContext::EvaluateString (this=0x1bdd1b70, aScript=@0x1dc519b4, aScopeObject=0x1db9d5c0, aPrincipal=0x1c388c80, aURL=0x1dc08418 "http://test.mozilla.com/tests/mozilla.org/js/js1_7/regress/regress-418641.js", aLineNo=1, aVersion=170, aRetValue=0x0, aIsUndefined=0xbfffc6d4) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/dom/src/base/nsJSEnvironment.cpp:1588

regressed by http://hg.mozilla.org/tracemonkey/rev/c0d189525474

occurs on 1.9.1, 1.9.1-tm, 1.9.2

Comment 1

[David Mandelin [:dmandelin]]

Attachment: Patch

Comment 2

[David Mandelin [:dmandelin]]

Pushed to TM as 4025f66494fd.

Comment 3

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/4025f66494fd

Comment 4

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/aa475847c086

Comment 5

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2