615853 - Intermittent MIPS crash in nanojit::Assembler::nPatchBranch

Status: RESOLVED WONTFIX

(Core Graveyard :: Nanojit, defect)

Description

[Brent Baker]

Attachment: stacktrace

There is an intermittent crash that is happening on MIPS when running the following tamarin acceptance test:

ecma3/Statements/eregress_74474_002.as

[Switching to Thread 0x78f000 (LWP 26153)]
0x006643fc in nanojit::Assembler::nPatchBranch (branch=0xaee320e, 
    target=0x2bb8c838)
    at /home/build/buildbot/tamarin-redux/linux-mips/repo/nanojit/NativeMIPS.cpp:1814


Full stacktrace is attached.
The version of nanojit in this tamarin is 1f90e61950c44193ea5a1800c06d7dba8240cfd9

Comment 1

[Brent Baker]

This does not appear to be a recent injection as I rolled back and tested the past 3 nanojit merges into tamarin, and the line of code that is causing the issue has not been touched since the MIPS backend was submitted.

This issue has most likely existed the entire time.

[Switching to Thread 0x775000 (LWP 26242)]
0x006548ec in nanojit::Assembler::nPatchBranch (branch=0xaee320e, 
    target=0x2bb8c838)
    at /home/build/hg/tamarin-redux/nanojit/NativeMIPS.cpp:1814
1814	        uint32_t op = (branch[0] >> 26) & 0x3f;

Comment 2

[Chris Dearman]

It seems like an incorrect address that is suspiciously low and not 4 byte aligned is being passed to nPatchBranch. I will try to reproduce the problem.

Comment 3

[Brent Baker]

Looks like the same error occurs in "ecma3/Statements/eregress_74474_003.as"

Comment 4

[Trevor Baker]

Is this still happening?  Chris, any luck reproducing?

Comment 5

[Chris Dearman]

No, I never reproduced this.

The "branch" value is supposed to be a GuardRecord->jmp value. The only place I can see this being assigned is in NativeMIPS.c:nFragExit where it gets a value of _nIns and I can't see how _nIns could get an unaligned value like this.

Comment 6

[Nicholas Nethercote [inactive]]

Nanojit has been dead for several years. Its Bugzilla component has been moved to the graveyard (bug 984276).

I checked all the open bugs. They're all uninteresting, so I'm WONTFIXing them all. Apologies for the bugspam.