Closed Bug 934427 Opened 6 years ago Closed 6 years ago

Crash [@ ScriptFromCalleeToken]

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla28
Tracking Status
firefox28 --- fixed

People

(Reporter: decoder, Assigned: djvj)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, regression, testcase, Whiteboard: [jsbugmon:update])

Crash Data

Attachments

(2 files, 1 obsolete file)

The following testcase crashes on mozilla-central revision 3dd1dc64123a (run with --fuzzing-safe):


test();
function test() {
var a1; var a2; var a3; var a4; var a5; var a6; var a7; var a8; var a9;
var p1=test();
var a11; var a12; var a13; var a14; var a15; var a16; var a17; var a18;
var a19; var a20; var a21; var a22; var a23; var a24; var a25; var a26; var a27; var a28;
var a29; var a30; var a31; var a32; var a33; var a34; var a35; var a36; var a37; var a38;
var a39; var a40; var a41; var a42; var a43; var a44; var a45; var a46; var a47; var a48;
var a49; var a50; var a51; var a52; var a53; var a54; var a55; var a56; var a57; var a58;
var a59; var a60; var a61; var a62; var a63; var a64; var a65; var a66; var a67; var a68;
var a69; var a70; var a71;
function testcase() {
    eval("true = 42");
}
var a73; var a74; var a75; var a76; var a77; var a78; var a79; var a80; var a81; var a82;
var a83; var a84; var a85; var a86; var a87; var a88; var a89; var a90; var a91; var a92;
var a93; var a94; var a95; var a96; var a97; var a98; var a99; var a100; var a101; var a102;
var a103; var a104; var a105; var a106;
var [ [ handler , [x]    ]    ]  = 40;
var a108; var a109; var a110; var a111; var a112; var a113; var a114; var a115; var a116;
var a117; var a118; var a119; var a120; var a121; var a122;
}
Shorter test:

function f(){
  var j;
  f(0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9);
}
f()
Attachment #826712 - Attachment is obsolete: true
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/c532cabb71ec
parent:      153134:ad2a5a4f53ec
user:        Kannan Vijayan
date:        Fri Nov 01 15:04:01 2013 -0400
summary:     Bug 852175 - Fix baseline stack checks on functions which may push lots of locals. r=jandem

This iteration took 422.542 seconds to run.
Kannan, is bug 852175 a likely regressor?
Blocks: 852175
Flags: needinfo?(kvijayan)
Keywords: regression
Seems likely.
Assignee: general → kvijayan
Issue is in CallVM handling from baseline mainline jitcode.  There are some CallVMs that may be entered in a "may or may not have locals pushed" context, if a failure occurred.

This applies to initScopeChain callVMs, as well as stackCheck callVMs.

Fix changes the 'preInitialize' flag into a 'Phase' enum that identifies the different contexts that callVMs can be called from.
Attachment #828730 - Flags: review?(jdemooij)
Flags: needinfo?(kvijayan)
Note: Just added test case to patch.
Duplicate of this bug: 934914
Attachment #828730 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/14eb74502c41
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.