925483 - crash in js::jit::ValueNumberer::markBlock(js::jit::MBasicBlock*)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-f73fab77-e190-45b0-a93e-05bad2131009.
=============================================================

This is at the top of the the list in the explosive report, and this specific signature doesn't have a bug associated with it.

Only two urls were listed in the reports:

https://www.facebook.com/
http://worldoftanks.eu/clanwars/maps/

I will reach out to users who crashed and see if we can find anything there.

Comment 1

[Jan de Mooij [:jandem]]

kairo, I don't see this crash on crash-stats. Can you confirm this is no longer a problem?

Comment 2

[Robert Kaiser]

https://crash-stats.mozilla.com/report/list?range_value=28&signature=js%3A%3Ajit%3A%3AValueNumberer%3A%3AmarkBlock(js%3A%3Ajit%3A%3AMBasicBlock*) leads me to believe this exists at least in 24, 25, and 26, but is extremely low volume.

Comment 3

[Robert Kaiser]

OK, that URL was shortened too much, https://crash-stats.mozilla.com/report/list?range_value=28&range_unit=days&process_type=any&signature=js%3A%3Ajit%3A%3AValueNumberer%3A%3AmarkBlock(js%3A%3Ajit%3A%3AMBasicBlock%2A) works.

Comment 4

[Robert Kaiser]

And given that bugzilla doesn't linkify the ending bracket as well, in this form the link is working here as well: https://crash-stats.mozilla.com/report/list?range_value=28&range_unit=days&process_type=any&signature=js%3A%3Ajit%3A%3AValueNumberer%3A%3AmarkBlock%28js%3A%3Ajit%3A%3AMBasicBlock%2A%29

Comment 5

[Dan Gohman [:sunfish]]

FYI, the ValueNumberer code has recently changed (bug 1004363), and there is no longer a js::jit::ValueNumberer::markBlock function, so we're unlikely to see this particular stack trace in future versions.

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to Dan Gohman [:sunfish] from comment #5)
> FYI, the ValueNumberer code has recently changed (bug 1004363), and there is
> no longer a js::jit::ValueNumberer::markBlock function, so we're unlikely to
> see this particular stack trace in future versions.

it was replace with ValueNumberer::VisibleValues::findLeader for which I find no crashes