493970 - Intermittent crash on tinderbox in the jit on adobe.com

Status: RESOLVED DUPLICATE of bug 493991

(Core :: JavaScript Engine, defect)

Description

[Jim Mathies [:jimm]]

intermittent crash on tinderbox in the jit on adobe.com - 

Thread 0 (crashed)
 0  js3250.dll!nanojit::LIns::isTramp() [LIR.h:acd2d4638228 : 347 + 0x0]
    eip = 0x002e2b90   esp = 0x0012f054   ebp = 0x008b1000   ebx = 0x00000003
    esi = 0x00000001   edi = 0x00cbd1d4   eax = 0x00cbd1d4   ecx = 0x00000002
    edx = 0x00000010   efl = 0x00010206
 1  js3250.dll!nanojit::Assembler::asm_call(nanojit::LIns *) [Nativei386.cpp:acd2d4638228 : 251 + 0x19]
    eip = 0x002e242f   esp = 0x0012f058   ebp = 0x008b1000
 2  js3250.dll!nanojit::Assembler::prepResultReg(nanojit::LIns *,int) [Assembler.cpp:acd2d4638228 : 635 + 0x9]
    eip = 0x002e391b   esp = 0x0012f0b4   ebp = 0x0001c0c8
 3  js3250.dll!nanojit::Assembler::gen(nanojit::LirFilter *,avmplus::List<unsigned char *,0> &) [Assembler.cpp:acd2d4638228 : 1477 + 0x6]
    eip = 0x002e32d4   esp = 0x0012f0c0   ebp = 0x02cbd1e4
 4  js3250.dll!nanojit::Assembler::assemble(nanojit::Fragment *,avmplus::List<unsigned char *,0> &) [Assembler.cpp:acd2d4638228 : 850 + 0x33]
    eip = 0x00338da5   esp = 0x0012f0dc   ebp = 0x008b1000
 5  js3250.dll!nanojit::compile(nanojit::Assembler *,nanojit::Fragment *) [LIR.cpp:acd2d4638228 : 2150 + 0xd]
    eip = 0x0033a147   esp = 0x0012f174   ebp = 0x0012f11c
 6  js3250.dll!TraceRecorder::compile(JSTraceMonitor *) [jstracer.cpp:acd2d4638228 : 2809 + 0xc]
    eip = 0x0033a276   esp = 0x0012f1c0   ebp = 0x0079503c
 7  js3250.dll!TraceRecorder::closeLoop(JSTraceMonitor *,bool &) [jstracer.cpp:acd2d4638228 : 2943 + 0xc]
    eip = 0x00335cad   esp = 0x0012f1d0   ebp = 0x0079503c
 8  js3250.dll!TraceRecorder::checkTraceEnd(unsigned char *) [jstracer.cpp:acd2d4638228 : 3242 + 0x12]
    eip = 0x0033760d   esp = 0x0012f1e8   ebp = 0x0012f248
 9  js3250.dll!TraceRecorder::relational(nanojit::LOpcode,bool) [jstracer.cpp:acd2d4638228 : 6135 + 0x5]
    eip = 0x003965bd   esp = 0x0012f1fc   ebp = 0x0012f248
10  js3250.dll!TraceRecorder::record_JSOP_LT() [jstracer.cpp:acd2d4638228 : 6977 + 0xa]
    eip = 0x00396c5e   esp = 0x0012f250   ebp = 0x023c3c00
11  js3250.dll!js_Interpret [jsinterp.cpp:acd2d4638228 : 3038 + 0x7]
    eip = 0x00318afb   esp = 0x0012f274   ebp = 0x023c3c00

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242823438.1242831846.14936.gz&fulltext=1

Comment 1

[Robert Sayre]

this is the 1.9.1 branch?

Comment 2

[Jim Mathies [:jimm]]

(In reply to comment #1)
> this is the 1.9.1 branch?

yes. jmuizelaar added to the comments that this might be a dupe of bug 491514, but I don't have access to that.

Comment 3

[Jesse Ruderman on Windows]

Let's hope bug 491514 or bug 493991 took care of this.