660850 - TI: Crash [@ js::mjit::JITScript::nativeToPC]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The attached testcase in the next comment crashes js debug shell on JM changeset 0cc71b0c30f4 with -m, -a and -n at js::mjit::JITScript::nativeToPC

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

debug stack on Linux

Comment 3

[Brian Hackett [Laid off!]]

The root problem here is that CompileFunction did not respect several invariants used in other call paths to make sure we are able to recompile a caller while in the middle of compiling its callee.  The VMFrame's regs were incorrect, the callee frame was being pushed onto f.regs inappropriately, the writes to ncode happened differently.  Other places in the recompiler code were hacking around this already, but these were incomplete.  Rather than pile more complexity onto CompileFunction, the fix below guts it so that it just pops the partially initialized frame and invokes UncachedNew/UncachedCall (a fix I've wanted to do for some time).

http://hg.mozilla.org/projects/jaegermonkey/rev/750eb028fb06