739402 - IonMonkey: Crash [@ EnterIon] or [@ js::ion::Cannon] or [@ CheckStackQuota] or [@ js::mjit::stubs::HitStackQuota]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming attached testcase crashes 32-bit js opt shell (compiled with --enable-more-deterministic) on IonMonkey changeset be41973873db with -m, -a, --ion and -n at EnterIon and js::ion::Cannon or CheckStackQuota and js::mjit::stubs::HitStackQuota

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This does not seem to reproduce with debug shells.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: vastly reduced version of the earlier testcase

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7fd3ee0 in ?? ()
#0  0x00007ffff7fd3ee0 in ?? ()
#1  0xfffafffff638e9e0 in ?? ()
#2  0x00007fffffffd568 in ?? ()
#3  0xfff880000000000a in ?? ()
#4  0xfff9000000000000 in ?? ()
#5  0x00007ffff7fecb52 in ?? ()
#6  0x0000000000000180 in ?? ()
#7  0x00007ffff6310b40 in ?? ()
#8  0x0000000000000001 in ?? ()
#9  0x00007fffffffd598 in ?? ()
#10 0xfff9000000000000 in ?? ()
#11 0xfffafffff638e9e0 in ?? ()
#12 0x00007ffff638e9e0 in ?? ()
#13 0x00007ffff7fe890c in ?? ()
#14 0x0000000000000081 in ?? ()
#15 0x00007ffff6310a80 in ?? ()
#16 0xfff9000000000000 in ?? ()
#17 0x00007fffffffd670 in ?? ()
#18 0x00007fffffffd790 in ?? ()
#19 0x000000000000ffff in ?? ()
#20 0x00007ffff7feca18 in ?? ()
#21 0x00007ffff65250b8 in ?? ()
#22 0x0000000000a55a90 in ?? ()
#23 0x00007fffffffd6b0 in ?? ()
#24 0x0000000000688cd0 in EnterIon (cx=0x1, fp=0x0, jitcode=0x7ffff65250b0) at /home/fuzz2lin/Desktop/jsfunfuzz-dbg-64-im-91657-55ab6c6d276a/compilePath/js/src/ion/Ion.cpp:964
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Tested with 64-bit js opt shell on IonMonkey changeset 55ab6c6d276a with --ion and -n in Ubuntu Linux 11.10.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

WFM as of IonMonkey changeset 72596946ff96.