1528037 - Crash in [@ js::jit::Assembler::GetPtr32Target]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Liz Henry (:lizzard) (relman/hg->git project)]

This bug is for crash report bp-5cd0eb87-95bd-4d8a-8c7a-af5940190213.

This crash signature spiked on 2/12 on Firefox for Android on release.
That seems a bit odd (That coincides with the dot release, but the crash spike is for 65.0)

Top 10 frames of crashing thread:

0 libxul.so js::jit::Assembler::GetPtr32Target js/src/jit/arm/Assembler-arm.cpp:884
1 libxul.so js::jit::Assembler::PatchDataWithValueCheck js/src/jit/arm/Assembler-arm.cpp:2977
2 libxul.so js::jit::IonCacheIRCompiler::compile js/src/jit/IonCacheIRCompiler.cpp:633
3 libxul.so js::jit::IonIC::attachCacheIRStub js/src/jit/IonCacheIRCompiler.cpp:2539
4 libxul.so js::jit::IonSetPropertyIC::update js/src/jit/IonIC.cpp:347
5  @0x3200e716 
6 libxul.so mbrtoc32 
7 libcrypto.so libcrypto.so@0x1eb3e 
8 libxul.so js::jit::LazyLinkTopActivation js/src/jit/Ion.cpp:569
9  @0x760c86d6 

Comment 1

[Nicolas B. Pierron [:nbp]]

This bug sounds actionable, it crashes with MOZ_CRASH(unsupported relocation) which imply that we generated an instruction which cannot be read with GetPtr32Target. Or that we are attempting to read something which is not part of the readable instructions.

Checking URLs of crash reports does not seems to lead to any particular website.

Comment 2

[Marcia Knous [:marcia]]

Adding 68 as affected as crashes are seen in 68 beta.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.