756855 - IonMonkey: Crash at weird location of 0x00000001005ead60 with testcase and --ion-eager

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: partially reduced testcase

The attached testcase crashes js opt shell on IonMonkey changeset 890dd17b4187 with --ion-eager at a weird address.

The testcase is fragile, so attaching partially reduced.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

--ion-eager is needed, and this crash does not seem to reproduce in debug builds.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Gary, could you retest this after the fix for bug 756659 lands? I think it's the same bug.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to David Anderson [:dvander] from comment #2)
> Gary, could you retest this after the fix for bug 756659 lands? I think it's
> the same bug.

Likely the same bug, seemingly no longer reproduces. -> FIXED

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Large fragile testcase -> in-testsuite-