TI: Assertion failure: frame not in stack space, at vm/Stack.cpp:273

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 531302 [details]
shell testcase, unpack, chdir and run main.js with options "-n -m -a"

The attached testcase asserts on TI revision 32e8c937a409 (run main.js with -m -n -a),
tested on 64 bit.
When getting a new frame in UncachedInlineCall, we would make a local copy of f.regs and repoint cx->regs to that (as the interpreter does).  In the TM branch this is an optimization, but for recompilation and frame expansion in the JM branch this is necessary as we want f.regs to reflect the state when the stub call was made for that f.  The problem was that if checking if we had space for the new frame triggered recompilation / inline frame expansion then the f.regs were being updated but the new cx->regs went stale.  We shouldn't make a local copy of cx->regs until we've checked there is space for the new frame and we are about to (infallibly) push it.  I don't think other places we make local copies of cx->regs have this issue (there are only a few).

http://hg.mozilla.org/projects/jaegermonkey/rev/0df33bc6cc38
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
You need to log in before you can comment on or make changes to this bug.