516009 - CSS transitions mochitest crashes with JIT enabled

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: test_transitions.html

The main mochitest that I'm working on for bug 435441 crashes when the JIT is enabled.  (It doesn't even require the transitions patch to crash.)

I've observed the crash on Windows an Linux; it seemed to have shown up as a hang on Mac on try server.

Steps to reproduce:
 * download the attached mochitest, and put it in $objdir/_tests/testing/mochitest/tests/layout/style/test and call it test_transitions.html
 * cd $objdir/_tests/testing/mochitest
 * python ./runtests.py --test-path=layout/style/test/test_transitions.html

This causes a crash when javascript.options.jit.content is true, but does not crash when the pref is false.  (Note that automation.py overrides this pref in the mochitest testing profile.)

Some crash reports from Linux:
bp-5d0a10e1-da6b-420a-b380-408eb2090911
bp-46c9202d-6fbf-4e2d-8ae8-33ed22090911
bp-471a3d5f-033c-45b0-a354-bc6db2090911
bp-a920b3d3-083d-462e-96ae-1b0102090911

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: stack from Windows debug build

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Also crashes in the 2009-09-11-03 Linux tracemonkey nightly.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: standalone version of testcase

Here's a testcase that doesn't require the mochitest harness and should just crash when you click the link to it in Bugzilla.

Comment 4

[Andreas Gal :gal]

Crash with 0xcdcdcdcd in a debug build means a free memory read. Until we know this doesn't affect 1.9.1 we should hide this.

Comment 5

[David Mandelin [:dmandelin]]

Attachment: Patch

See bug 508711 for the cause (and a note that there are still other latent bugs of this type).

Comment 6

[David Mandelin [:dmandelin]]

Attachment: Patch 2 (forgot test case last time)

Comment 7

[David Mandelin [:dmandelin]]

Pushed to TM as cf9a092205cc.

Andreas: you r+'d the wrong patch. But the only difference is the addition of a test case, so I just pushed.

Comment 8

[Andreas Gal :gal]

Yeah sorry.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Do we need this patch on 1.9.1, or is that safe?

Comment 10

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/cf9a092205cc

Comment 12

[Robert Sayre]

(In reply to comment #9)
> Do we need this patch on 1.9.1, or is that safe?

gal, dmandelin?

Comment 13

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/21d758a56d59

Comment 14

[Samuel Sidler (old account; do not CC)]

(In reply to comment #12)
> (In reply to comment #9)
> > Do we need this patch on 1.9.1, or is that safe?
> 
> gal, dmandelin?

Still looking for an answer here...

Comment 15

[David Mandelin [:dmandelin]]

Sorry for the delay. This bug does not affect 1.9.1. It happens when tracing JSOP_LAMBDA_FC, which is not done in 1.9.1.

Comment 16

[Bob Clary [:bc] (inactive)]

js/src/trace-test/tests/basic/bug516009.js
v 1.9.3, 1.9.2