1531889 - Firefox crashes toggling the javascript.options.baseline pref in debug builds

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement, P3)

Description

[Ted Campbell [:tcampbell]]

If you build a full browser with asserts compiled in and then try to disable baseline / ion from about:config the browser crashes at https://searchfox.org/mozilla-central/rev/00f3836a87b844b5e4bc82f698c559b9966e4be2/js/src/jit/Jit.cpp#25

We probably don't clear scripts when toggling the pref so the next Interp -> Baseline call edge will crash.

Comment 1

[Ted Campbell [:tcampbell]]

https://searchfox.org/mozilla-central/rev/00f3836a87b844b5e4bc82f698c559b9966e4be2/js/xpconnect/src/XPCJSContext.cpp#870

Looks like there is no purging of jitcode when we toggle options.

Comment 2

[Lars T Hansen [:lth]]

Also see https://bugzilla.mozilla.org/show_bug.cgi?id=1523564 which is another crash stack for the same problem.

Comment 3

[Ted Campbell [:tcampbell]]

(Fixed by making JIT prefs read on startup only)