737242 - IonMonkey: Crash [@ js::Vector<JSC::ExecutablePool*, 2ul, js::SystemAllocPolicy>] or [@ js::mjit::ic::BasePolyIC::releasePools]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming testcase crashes js debug shell on IonMonkey changeset b5b6e6aebb36 with -m, -a, and -n at a js::Vector<JSC::ExecutablePool*, 2ul, js::SystemAllocPolicy> and crashes js opt shell at js::mjit::ic::BasePolyIC::releasePools

Does not seem to occur with mozilla-central changeset fc8534cfca3d.

Comment 2

[Christian Holler (:decoder)]

Assuming s-s from the description until triaged.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Assuming s-s from the description until triaged.

I can no longer reproduce this, not even with the original changeset. Opening up.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> I can no longer reproduce this, not even with the original changeset.
> Opening up.

Actually I can reproduce with --ion added, but the testcase is intermittent rendering any bisection moot.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Actually I can reproduce with --ion added, but the testcase is intermittent
> rendering any bisection moot.

I meant I can reproduce with the original changeset, but not with the latest one.

Confirming WFM now.