737589 - IonMonkey: Crash [@ js::ion::IonScript::snapshotsSize] (ARM only)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase crashes on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m --ion-eager).

Comment 1

[Christian Holler (:decoder)]

ARM only crash, backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00334b42 in js::ion::IonScript::snapshotsSize (this=0x0) at ../ion/IonCode.h:322
322             return snapshotsSize_;
(gdb) bt 8
#0  0x00334b42 in js::ion::IonScript::snapshotsSize (this=0x0) at ../ion/IonCode.h:322
#1  0x0039ddba in ConvertFrames (cx=0x119c948, activation=0xbe9b9f50, in=...) at /home/decoder/ionmonkey/js/src/ion/Bailouts.cpp:293
#2  0x0039e144 in js::ion::Bailout (sp=0xbe9b9da0) at /home/decoder/ionmonkey/js/src/ion/Bailouts.cpp:416
#3  0x4017d55c in ?? ()
Cannot access memory at address 0xffffff81
#4  0x4017d55c in ?? ()
Cannot access memory at address 0xffffff81
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Comment 2

[Christian Holler (:decoder)]

This doesn't reproduce for me anymore. I'll be hard to bisect since it's ARM only. 

Martin, do you know if this is really fixed?