807859 - Crash [@ js::EncapsulatedPtr] with --enable-root-analysis and gczeal(7)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

gczeal(7)
x = {}
try {
    (function() {
        x.h = (function() {})
    })()
} catch (e) {}

crashes js debug shell (with --enable-root-analysis) on m-c changeset 570c7cb5b03d with --ion-eager at js::EncapsulatedPtr

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(This was also compiled with --enable-more-deterministic)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   116313:20646e439eb7
user:        Steve Fink
date:        Mon Dec 17 11:55:02 2012 -0800
summary:     Bug 821123 - do not assume the first rooter has been scanned. r=terrence

Possibly fixed by bug 821123.