947661 - Crash at a weird memory address with [@ EnterBaseline] or [@ js::jit::EnterBaselineMethod] on the stack

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: lldb stack

(function() {
    var x, y, z = (let(x) eval())
})()

crashes js debug and opt shell on m-c changeset edac8cba9f78 with --ion-eager at a weird memory address with EnterBaseline on the stack.

s-s because 0xfff9000000000000 seems to be accessed, locking just-in-case.

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

=== Tinderbox Build Bisection Results ===

Last "good" changeset has timestamp "20131207111101" and the hash "b50d803d0ad5"
First "bad" changeset has timestamp "20131207151002" and the hash "edac8cba9f78"

Likely regression window: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b50d803d0ad5&tochange=edac8cba9f78

===

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/5bb192fc539e
user:        Brian Hackett
date:        Sat Dec 07 11:03:07 2013 -0800
summary:     Bug 944930 - Remove block index from aliasedvar ops, use a binary search to find the block chain for a given pc, r=luke.

Brian, is bug 944930 a possible regressor?

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Stupid bounds check error.

Comment 4

[Brian Hackett [Laid off!]]

Pushing ahead of review to maybe make tomorrow's nightly.

https://hg.mozilla.org/integration/mozilla-inbound/rev/cb0546838451

Comment 5

[Carsten Book [:Tomcat]]

landed on central https://hg.mozilla.org/mozilla-central/rev/cb0546838451

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.