Closed
Bug 1264429
Opened 8 years ago
Closed 8 years ago
Intermittent array-iterator-generic.js | Unknown (code -11, args "--ion-eager --ion-offthread-compile=off")
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla48
Tracking | Status | |
---|---|---|
firefox48 | --- | fixed |
People
(Reporter: KWierso, Assigned: jonco)
References
Details
(Keywords: intermittent-failure)
Attachments
(1 file)
2.39 KB,
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
Assignee | ||
Updated•8 years ago
|
Assignee: nobody → jcoppeard
Assignee | ||
Comment 1•8 years ago
|
||
IonCache has a script pointer which needs to be traced so that it can be updated if the script is moved. This can be accessed by an IC slow path which may be active on the stack even though we invalidate JIT code when we do a compacting GC.
Attachment #8741423 -
Flags: review?(terrence)
Assignee | ||
Comment 2•8 years ago
|
||
BTW, this didn't reproduce at all when run normally but |rr record --chaos| hit it every time.
Comment 3•8 years ago
|
||
Comment on attachment 8741423 [details] [diff] [review] bug1264429-trace-ion-cache-script Review of attachment 8741423 [details] [diff] [review]: ----------------------------------------------------------------- This. This sort bug is why nobody thought that moving scripts would be possible. And I guess it wouldn't be without rr + chaos mode.
Attachment #8741423 -
Flags: review?(terrence) → review+
Reporter | ||
Comment 5•8 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/3f471f76af29
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
You need to log in
before you can comment on or make changes to this bug.
Description
•