807865 - Crash [@ js::ion::GetPropertyCache] with --enable-root-analysis and gczeal(6)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

gczeal(6)
x = WeakMap()
try {
    (function() {
        x.t()
    })()
} catch (e) {}

crashes 32-bit js debug shell (with --enable-root-analysis) on m-c changeset e13300fe685d with --ion-eager at js::ion::GetPropertyCache

Full compilation configuration on Mac 10.7:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -fcolor-diagnostics -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -fcolor-diagnostics -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -fcolor-diagnostics" HOST_CXX="clang++ -Qunused-arguments -fcolor-diagnostics" ./configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-root-analysis --enable-valgrind

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   116314:1d71ba26519f
user:        Steve Fink
date:        Mon Dec 17 11:55:15 2012 -0800
summary:     Bug 817818 - Miscellaneous rooting fixes. r=terrence

Probably fixed by bug 817818.