728509 - Crash [@ js::mjit::EnterMethodJIT] with mjitChunkLimit

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function g(code) {
    try {
        f = eval("(function(){" + code + "})")
    } catch (r) {}
    f()
    try {
        evalcx("(function(){return" + code + "})()")
    } catch (e) {}
}
g("mjitChunkLimit(8)")
g(" function(x,[]){NaN.x::c}()")


crashes js opt 32-bit shell on m-c changeset 78fde7e54d92 with -m, -a and -n at js::mjit::EnterMethodJIT

Assuming related to chunk patch in bug 722598. s-s because crashing on opt in Windows seems scary, together with the fact that I don't seem to see this signature on other platforms.

Comment 1

[Brian Hackett [Laid off!]]

I can't repro this but it sure looks like bug 728342.  Can you see if that patch fixes this one?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Crashes in m-c changeset 39ea8d8f9768 but not in 13b571bde26a. The latter contains the patches from bug 728342.

-> assuming FIXED by bug 728342

Comment 3

[Daniel Veditz [:dveditz]]

If that's true then a better candidate for a regressor is bug 706914

Comment 4

[Al Billings [:abillings - ex-MoCo]]

Verified crash and fix in js shell.

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929