Nightly 20170228030203 crash in js::jit::IonCacheIRCompiler::compile with unboxed arrays

RESOLVED INVALID

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED INVALID
a year ago
a year ago

People

(Reporter: Ekanan Ketunuti, Unassigned)

Tracking

({crash})

Trunk
x86
Windows 10
crash
Points:
---

Firefox Tracking Flags

(firefox54 affected)

Details

(crash signature)

(Reporter)

Description

a year ago
This bug was filed from the Socorro interface and is 
report bp-6aeb458c-8a0e-48da-b9cd-d67d22170301.
=============================================================

Steps:
1. export JS_OPTION_USE_UNBOXED_ARRAYS=1
2. start firefox
3. load https://mail.google.com/mail/u/0/#inbox

The first bad revision is
o  changeset:   382568:d4f1db56ebc0
|  user:        Jan de Mooij <jdemooij@mozilla.com>
~  date:        Mon Feb 27 09:32:49 2017 +0100
   description: Bug 1341067 - Port Ion SetProp/SetElem IC to CacheIR. r=h4writer
Flags: needinfo?(jdemooij)
This was intentional. Unboxed arrays are broken currently (jit-tests don't pass with --unboxed-arrays), so it's hard to write code for them. I added a MOZ_CRASH so we can revisit this if we ever decide to ship unboxed arrays.

Why are you using JS_OPTION_USE_UNBOXED_ARRAYS?
Flags: needinfo?(jdemooij)
(Reporter)

Comment 2

a year ago
> This was intentional. 

hence, resolving INVALID.

> Why are you using JS_OPTION_USE_UNBOXED_ARRAYS?

i added this env since it landed long ago and forgot about it till it crashed with today build.
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.