Closed Bug 1264429 Opened 8 years ago Closed 8 years ago

Intermittent array-iterator-generic.js | Unknown (code -11, args "--ion-eager --ion-offthread-compile=off")

Categories

(Core :: JavaScript Engine: JIT, defect)

48 Branch
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla48
Tracking Status
firefox48 --- fixed

People

(Reporter: KWierso, Assigned: jonco)

References

Details

(Keywords: intermittent-failure)

Attachments

(1 file)

Assignee: nobody → jcoppeard
IonCache has a script pointer which needs to be traced so that it can be updated if the script is moved.

This can be accessed by an IC slow path which may be active on the stack even though we invalidate JIT code when we do a compacting GC.
Attachment #8741423 - Flags: review?(terrence)
BTW, this didn't reproduce at all when run normally but |rr record --chaos| hit it every time.
Comment on attachment 8741423 [details] [diff] [review]
bug1264429-trace-ion-cache-script

Review of attachment 8741423 [details] [diff] [review]:
-----------------------------------------------------------------

This. This sort bug is why nobody thought that moving scripts would be possible. And I guess it wouldn't be without rr + chaos mode.
Attachment #8741423 - Flags: review?(terrence) → review+
https://hg.mozilla.org/mozilla-central/rev/3f471f76af29
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
You need to log in before you can comment on or make changes to this bug.