1564651 - Crash in [@ JSScript::updateJitCodeRaw] if you try to toggle the blinterp pref to true

Status: RESOLVED DUPLICATE of bug 1564349

(Core :: JavaScript Engine: JIT, defect)

Description

[Taegeon Lee]

This bug is for crash report bp-f01ebafe-2083-449e-8e6c-8ac4c0190710.

Top 10 frames of crashing thread:

0 xul.dll JSScript::updateJitCodeRaw js/src/vm/JSScript.cpp
1 xul.dll JSScript::createJitScript js/src/jit/JitScript.cpp:137
2 xul.dll js::jit::BaselineCompiler::compile js/src/jit/BaselineCompiler.cpp:161
3 xul.dll js::jit::BaselineCompile js/src/jit/BaselineJIT.cpp:229
4 xul.dll js::jit::MethodStatus js::jit::CanEnterBaselineMethod<js::jit::BaselineTier::Compiler> js/src/jit/BaselineJIT.cpp:413
5 xul.dll js::jit::MaybeEnterJit js/src/jit/Jit.cpp:169
6 xul.dll js::RunScript js/src/vm/Interpreter.cpp:410
7 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:568
8 xul.dll static bool InternalCall js/src/vm/Interpreter.cpp:595
9 xul.dll js::Call js/src/vm/Interpreter.cpp:611

Comment 1

[Mayank Bansal]

Confirmed.
STR:

1. Create new profile
2. Go to about:config , and search for "javascript.options.blinterp"
3. Click on the "toggle" button
4. Crash

Comment 2

[Jan de Mooij [:jandem]]

This will be fixed by bug 1564349. Sorry about that!