IonMonkey: Crash [@ js::ion::IonScript::snapshotsSize] (ARM only)

RESOLVED WORKSFORME

Status

()

--
major
RESOLVED WORKSFORME
7 years ago
6 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Other Branch
ARM
Linux
crash, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 607673 [details]
Testcase for shell

The attached testcase crashes on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m --ion-eager).
(Reporter)

Comment 1

7 years ago
ARM only crash, backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00334b42 in js::ion::IonScript::snapshotsSize (this=0x0) at ../ion/IonCode.h:322
322             return snapshotsSize_;
(gdb) bt 8
#0  0x00334b42 in js::ion::IonScript::snapshotsSize (this=0x0) at ../ion/IonCode.h:322
#1  0x0039ddba in ConvertFrames (cx=0x119c948, activation=0xbe9b9f50, in=...) at /home/decoder/ionmonkey/js/src/ion/Bailouts.cpp:293
#2  0x0039e144 in js::ion::Bailout (sp=0xbe9b9da0) at /home/decoder/ionmonkey/js/src/ion/Bailouts.cpp:416
#3  0x4017d55c in ?? ()
Cannot access memory at address 0xffffff81
#4  0x4017d55c in ?? ()
Cannot access memory at address 0xffffff81
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(Reporter)

Comment 2

7 years ago
This doesn't reproduce for me anymore. I'll be hard to bisect since it's ARM only. 

Martin, do you know if this is really fixed?
Summary: IonMonkey: Crash [@ js::ion::IonScript::snapshotsSize] → IonMonkey: Crash [@ js::ion::IonScript::snapshotsSize] (ARM only)
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.