The default bug view has changed. See this FAQ.

IonMonkey: Crash at weird location of 0x00000001005ead60 with testcase and --ion-eager

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: dvander)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Other Branch
x86
Mac OS X
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 625474 [details]
partially reduced testcase

The attached testcase crashes js opt shell on IonMonkey changeset 890dd17b4187 with --ion-eager at a weird address.

The testcase is fragile, so attaching partially reduced.
(Reporter)

Comment 1

5 years ago
Created attachment 625475 [details]
stack

--ion-eager is needed, and this crash does not seem to reproduce in debug builds.
(Assignee)

Comment 2

5 years ago
Gary, could you retest this after the fix for bug 756659 lands? I think it's the same bug.
(Assignee)

Updated

5 years ago
Assignee: general → dvander
Status: NEW → ASSIGNED
(Reporter)

Comment 3

5 years ago
(In reply to David Anderson [:dvander] from comment #2)
> Gary, could you retest this after the fix for bug 756659 lands? I think it's
> the same bug.

Likely the same bug, seemingly no longer reproduces. -> FIXED
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Group: core-security
(Reporter)

Comment 4

5 years ago
Large fragile testcase -> in-testsuite-
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.