Last Comment Bug 728509 - Crash [@ js::mjit::EnterMethodJIT] with mjitChunkLimit
: Crash [@ js::mjit::EnterMethodJIT] with mjitChunkLimit
Status: VERIFIED FIXED
[sg:critical] js-triage-needed
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Windows 7
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: jsfunfuzz 706914
  Show dependency treegraph
 
Reported: 2012-02-17 19:16 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 14:04 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
fixed
fixed
unaffected


Attachments
stack (7.16 KB, text/plain)
2012-02-17 19:16 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2012-02-17 19:16:52 PST
Created attachment 598470 [details]
stack

function g(code) {
    try {
        f = eval("(function(){" + code + "})")
    } catch (r) {}
    f()
    try {
        evalcx("(function(){return" + code + "})()")
    } catch (e) {}
}
g("mjitChunkLimit(8)")
g(" function(x,[]){NaN.x::c}()")


crashes js opt 32-bit shell on m-c changeset 78fde7e54d92 with -m, -a and -n at js::mjit::EnterMethodJIT

Assuming related to chunk patch in bug 722598. s-s because crashing on opt in Windows seems scary, together with the fact that I don't seem to see this signature on other platforms.
Comment 1 Brian Hackett (:bhackett) 2012-02-20 14:44:33 PST
I can't repro this but it sure looks like bug 728342.  Can you see if that patch fixes this one?
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-02-23 14:35:52 PST
Crashes in m-c changeset 39ea8d8f9768 but not in 13b571bde26a. The latter contains the patches from bug 728342.

-> assuming FIXED by bug 728342
Comment 3 Daniel Veditz [:dveditz] 2012-03-15 17:09:03 PDT
If that's true then a better candidate for a regressor is bug 706914
Comment 4 Al Billings [:abillings] 2012-03-16 13:46:48 PDT
Verified crash and fix in js shell.
Comment 5 Christian Holler (:decoder) 2013-01-19 14:04:37 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.