TI: Crash [@ JSC::MacroAssemblerCodePtr::executableAddress] or "Assertion failure: Missing rejoin," with e4x

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, crash, testcase})

Trunk
x86
Linux
assertion, crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 550966 [details]
stack

with( <x/> ) {
    (function () {
        for (;;) {
            t
        }
    })()
}

crashes js debug shell on JM changeset e1508f49adc4 with -m, -a and -n at JSC::MacroAssemblerCodePtr::executableAddress
(Reporter)

Comment 1

7 years ago
with( <x/> ) {
  (function () {
    for (b = 0; b < 18; ++b) {}
  })();
}

This variant asserts at Assertion failure: Missing rejoin,
Keywords: assertion
Summary: TI: Crash [@ JSC::MacroAssemblerCodePtr::executableAddress] → TI: Crash [@ JSC::MacroAssemblerCodePtr::executableAddress] or "Assertion failure: Missing rejoin," with e4x
(Reporter)

Updated

7 years ago
Whiteboard: js-triage-needed
Two separate issues, both triggered by a recompilation activity while binding NAME accesses.  The first was due to continuing to access the PIC structure after a lookup triggered recompilation activity, the second was due to not having any way to rejoin from a BINDNAME (there is no longer a need to distinguish this from other fallthrough opcodes, as the distinction was only needed for non-decomposed property incops).

http://hg.mozilla.org/projects/jaegermonkey/rev/723b6c299574
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/recompile/bug676764.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.