Created attachment 607673 [details] Testcase for shell The attached testcase crashes on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m --ion-eager).
ARM only crash, backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00334b42 in js::ion::IonScript::snapshotsSize (this=0x0) at ../ion/IonCode.h:322 322 return snapshotsSize_; (gdb) bt 8 #0 0x00334b42 in js::ion::IonScript::snapshotsSize (this=0x0) at ../ion/IonCode.h:322 #1 0x0039ddba in ConvertFrames (cx=0x119c948, activation=0xbe9b9f50, in=...) at /home/decoder/ionmonkey/js/src/ion/Bailouts.cpp:293 #2 0x0039e144 in js::ion::Bailout (sp=0xbe9b9da0) at /home/decoder/ionmonkey/js/src/ion/Bailouts.cpp:416 #3 0x4017d55c in ?? () Cannot access memory at address 0xffffff81 #4 0x4017d55c in ?? () Cannot access memory at address 0xffffff81 Backtrace stopped: previous frame identical to this frame (corrupt stack?)
This doesn't reproduce for me anymore. I'll be hard to bisect since it's ARM only. Martin, do you know if this is really fixed?
Summary: IonMonkey: Crash [@ js::ion::IonScript::snapshotsSize] → IonMonkey: Crash [@ js::ion::IonScript::snapshotsSize] (ARM only)
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.