GenerationalGC: Crash [@ js::ion::GetPropertyIC::UpdateInfo]

RESOLVED DUPLICATE of bug 906236

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 906236
5 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
x86_64
Linux
crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 791580 [details]
stack

try {
    (2, {})
} catch (e) {}
try {
    (function() {
        Object.defineProperty(this, "v1", {
            get: function() {
                Object.e({
                    l: false,
                    o: true,
                    l: (Object(({
                        s: ((function f(vsollj) {
                            print
                            f(vsollj)
                            const d = eval(""), w = ((("")))
                        })(2))
                    }))),
                    n: e,
                    n: f
                })
            }
        })
    })
    ()
    (v1)
    (function() {
        ({})
    })
} catch (e) {}

crashes js debug shell (tested with a threadsafe 64-bit debug build) on m-i changeset a63f47fcbe98 without any CLI arguments at js::ion::GetPropertyIC::UpdateInfo

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   140539:1a0e01422cb3
user:        Terrence Cole
date:        Wed Jul 10 10:13:46 2013 -0700
summary:     Bug 889682 - Eagerly check for remembered set membership before buffering; r=billm
Flags: needinfo?(terrence)
This is the same issue as bug 906236. 

I've verified that the patch posted there fixes this issue too.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: needinfo?(terrence)
Resolution: --- → DUPLICATE
Duplicate of bug: 906236
You need to log in before you can comment on or make changes to this bug.