IonMonkey: Opt-only Crash [@ GetGCThingTraceKind]

RESOLVED DUPLICATE of bug 757785

Status

()

Core
JavaScript Engine
--
major
RESOLVED DUPLICATE of bug 757785
6 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Other Branch
x86_64
Linux
crash, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 628075 [details]
Testcase for shell

The attached testcase crashes on ionmonkey revision 4ce3983a43f4 (run with --ion -n -m --ion-eager).
Can't reproduce on opt/dbg x86/x64 with 629d1e6261b9.
I can't reproduce this on tip or the given cset.
(Reporter)

Comment 3

6 years ago
(In reply to David Anderson [:dvander] from comment #2)
> I can't reproduce this on tip or the given cset.

The test contains gczeal, that means you need to build the opt shell using:

--enable-optimize --disable-debug --enable-valgrind --enable-gczeal.

Can you retry with that config?
(In reply to Christian Holler (:decoder) from comment #3)
> (In reply to David Anderson [:dvander] from comment #2)
> > I can't reproduce this on tip or the given cset.
> 
> The test contains gczeal, that means you need to build the opt shell using:
> 
> --enable-optimize --disable-debug --enable-valgrind --enable-gczeal.
> 
> Can you retry with that config?

Thanks, I can repro against the given cset and confirmed fixed by bug 757785.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 757785
Group: core-security
You need to log in before you can comment on or make changes to this bug.