504043 - Firefox will crash on sparc platform when some website.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Leon Sha]

Attachment: Stack trace of this crash

Visiting http://coastalmap.marine.usgs.gov/ArcIms/Website/usa/eastcoast/atlanticcoast/viewer.htm on sparc, firefox will crash. If jit is disabled, no crash.

Comment 1

[Leon Sha]

Attachment: patch

Normally functions are executed one by one. In javascript engine with JIT enabled, there is a possibility that two functions are joint. The code can jump from one function to another. On sparc, the stack size is fixed when a function is generated. This bug happened when jumping from a small stack function (FUNC A) to a bug stack function(FUNC B). When this happened, the code running is belong to FUNC B, but actually it is still running in this FUNC A because there is no call or return happened. In the FUNC B there maybe some stack written activity happen which destroy the FUNC A's stack. The solution here is we do the same as X86 did. Add another line to decrease stack point after save. Every time we join the two functions we will re-calculate the stack point to meet the requirement. The code is much more like x86 now. The difference is that we don't need to restore the stack point before jump since we get the stack point directly from frame point. I have tested this patch to pass the trace-test.js and tamarin-redux acceptance test.

Comment 2

[Leon Sha]

http://hg.mozilla.org/tracemonkey/rev/22313a951d50

Comment 3

[Leon Sha]

Comment on attachment 388440 [details] [diff] [review]
patch

This is a NPOTB code change. Should be safe to land mozilla-1.9.1 branch. This bug will crash firefox on sparc.

Comment 4

[Samuel Sidler (old account; do not CC)]

Comment on attachment 388440 [details] [diff] [review]
patch

Approved for 1.9.1.2. a=NPOTB, aka ss.

Please land on mozilla-1.9.1 and use the ".2-fixed" option of the "status1.9.1" flag.

Comment 5

[Leon Sha]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/42b97b255405