https://tbpl.mozilla.org/php/getParsedLog.php?id=20314516&tree=Mozilla-Inbound Linux x86-64 mozilla-inbound leak test spidermonkey_mozilla-inbound-rootanalysis build on 2013-03-04 14:37:20 PST for push 6af9594ac0d4 slave: bld-linux64-ec2-347 FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/jaeger/bug738525.js TEST-UNEXPECTED-FAIL | jit_test.py --no-ion --no-jm --no-ti| /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/jaeger/bug738525.js: Assertion failure: !js::IsPoisonedPtr(l), at /builds/slave/m-in_l64-d_sm-rootanalysis-000/objdir/dist/include/js/HashTable.h:489

I managed to collect a core from this error. Here is the backtrace.

With the patch from Bug 852802 this reproduces for me about 1 in 50 runs, so I was able to verify success by running ~200 times without failure. I'm guessing this is a weird compilation bug: as far as I can tell there are zero rooting failures in the existing code. The crash failure went away when I removed the intermediate IdStringifier class: perhaps the nesting was confusing g++. The extra Handle additions and removal of the manual rooting are just cleanups that I'm throwing in because I was in the area.

Comment on attachment 731404 [details] [diff] [review] v0 Review of attachment 731404 [details] [diff] [review]: ----------------------------------------------------------------- Works for me. I still don't really understand why it was intermittent, though. At any rate, it's good to see the JS_AddNamedStringRoot go away.