Closed Bug 580909 Opened 14 years ago Closed 14 years ago

JM: Crash [@ js::mjit::stubs::SetName] or "Assertion failure: entry->vword.isSprop(),"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(4 keywords)

Crash Data

--''.trimLeft

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: entry->vword.isSprop(), at ../methodjit/StubCalls.cpp:149 and crashes js opt shell at js::mjit::stubs::SetName.

Program received signal SIGSEGV, Segmentation fault.
0x082188f7 in js::mjit::stubs::SetName(js::VMFrame&, JSAtom*) ()
(gdb) bt
#0  0x082188f7 in js::mjit::stubs::SetName(js::VMFrame&, JSAtom*) ()
#1  0x08277288 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x/i $eip
=> 0x82188f7 <_ZN2js4mjit5stubs7SetNameERNS_7VMFrameEP6JSAtom+487>:	testb  $0x40,0x10(%edx)
Works for me on moo tip 64-bit, but fails on 32-bit.
Works for me on 32-bit with ICs disabled.
Crash Signature: [@ js::mjit::stubs::SetName]
You need to log in before you can comment on or make changes to this bug.