676764 - TI: Crash [@ JSC::MacroAssemblerCodePtr::executableAddress] or "Assertion failure: Missing rejoin," with e4x

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

with( <x/> ) {
    (function () {
        for (;;) {
            t
        }
    })()
}

crashes js debug shell on JM changeset e1508f49adc4 with -m, -a and -n at JSC::MacroAssemblerCodePtr::executableAddress

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

with( <x/> ) {
  (function () {
    for (b = 0; b < 18; ++b) {}
  })();
}

This variant asserts at Assertion failure: Missing rejoin,

Comment 2

[Brian Hackett [Laid off!]]

Two separate issues, both triggered by a recompilation activity while binding NAME accesses.  The first was due to continuing to access the PIC structure after a lookup triggered recompilation activity, the second was due to not having any way to rejoin from a BINDNAME (there is no longer a need to distinguish this from other fallthrough opcodes, as the distinction was only needed for non-decomposed property incops).

http://hg.mozilla.org/projects/jaegermonkey/rev/723b6c299574

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/recompile/bug676764.js.