Closed
Bug 880886
Opened 11 years ago
Closed 11 years ago
GenerationalGC: Crash [@ CanReuseFunctionForClone] or Opt-Crash [@ compartment]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla24
People
(Reporter: decoder, Assigned: terrence)
References
Details
(Keywords: crash, testcase, Whiteboard: [jsbugmon:ignore])
Crash Data
Attachments
(2 files, 1 obsolete file)
|
(deleted),
text/plain
|
Details | |
|
(deleted),
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
The following testcase crashes on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 9ca690835a5e (run with ):
function testUniqueness(asmJSModule) {
var f = asmJSModule();
}
function lambda() {
var x = function inner() { "use asm"; function g() {} return g };
return lambda();
}
testUniqueness(lambda);
|
Reporter | |
Comment 1•11 years ago
|
||
|
Assignee | |
Comment 2•11 years ago
|
||
This does not reproduce after applying the patch in bug 880816.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Comment 3•11 years ago
|
||
Brian wants a different approach for bug 880816, so lets handle this separately.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
|
|
Assignee | |
Comment 4•11 years ago
|
||
Always allocate AsmJS's JSFunction tenured.
Assignee: general → terrence
Status: REOPENED → ASSIGNED
Attachment #761028 -
Flags: review?(bhackett1024)
|
|
Assignee | |
Comment 5•11 years ago
|
||
Attachment #761028 -
Attachment is obsolete: true
Attachment #761028 -
Flags: review?(bhackett1024)
Attachment #761032 -
Flags: review?(bhackett1024)
|
||
Updated•11 years ago
|
Attachment #761032 -
Flags: review?(bhackett1024) → review+
|
|
Assignee | |
Comment 6•11 years ago
|
||
|
||
Comment 7•11 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 11 years ago → 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in
before you can comment on or make changes to this bug.
Description
•