Closed
Bug 774767
Opened 12 years ago
Closed 12 years ago
IonMonkey: Crash when walking the stack of IonMonkey frames
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 736299
People
(Reporter: ehsan.akhgari, Unassigned)
References
Details
STR:
1. Grab an IonMonkey nightly, and install the Gecko Profiler extension.
2. Browse to the following URL which is just a long running script which gets compiled using Ion:
data:text/html,<script>function f(a){return a+1;} for (var i = 0; i < 10000000; ++i) window.x=f(window.x);</script>
You'll see crashes like this https://crash-stats.mozilla.com/report/index/bp-e008024c-2ce0-4d07-ac0f-d02c42120717 which happen quite reliably, perhaps because of a bad frame generated by Ion.
|
||
Comment 1•12 years ago
|
||
The frame pointer is not implemented yet (see Bug 736299)
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Summary: Crash when walking the stack of IonMonkey frames → IonMonkey: Crash when walking the stack of IonMonkey frames
Profiling won't work with IonMonkey also because it's not integrated with the JIT yet. This could also be some sort wild writes to memory because the SPS stack isn't properly maintained.
You need to log in
before you can comment on or make changes to this bug.
Description
•