Closed
Bug 737242
Opened 14 years ago
Closed 14 years ago
IonMonkey: Crash [@ js::Vector<JSC::ExecutablePool*, 2ul, js::SystemAllocPolicy>] or [@ js::mjit::ic::BasePolyIC::releasePools]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(1 file)
|
7.81 KB,
text/plain
|
Details |
The upcoming testcase crashes js debug shell on IonMonkey changeset b5b6e6aebb36 with -m, -a, and -n at a js::Vector<JSC::ExecutablePool*, 2ul, js::SystemAllocPolicy> and crashes js opt shell at js::mjit::ic::BasePolyIC::releasePools
Does not seem to occur with mozilla-central changeset fc8534cfca3d.
|
||
Updated•14 years ago
|
Version: Trunk → Other Branch
|
Reporter | |
Comment 3•14 years ago
|
||
> Assuming s-s from the description until triaged.
I can no longer reproduce this, not even with the original changeset. Opening up.
Group: core-security
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
|
|
Reporter | |
Comment 4•14 years ago
|
||
> I can no longer reproduce this, not even with the original changeset.
> Opening up.
Actually I can reproduce with --ion added, but the testcase is intermittent rendering any bisection moot.
|
|
Reporter | |
Comment 5•14 years ago
|
||
> Actually I can reproduce with --ion added, but the testcase is intermittent
> rendering any bisection moot.
I meant I can reproduce with the original changeset, but not with the latest one.
Confirming WFM now.
You need to log in
before you can comment on or make changes to this bug.
Description
•