Closed
Bug 880840
Opened 11 years ago
Closed 11 years ago
GenerationalGC: Crash [@ GetGCThingRuntime] or Opt-Crash [@ getClass]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 880816
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: crash, testcase, Whiteboard: [jsbugmon:ignore])
Crash Data
Attachments
(1 file)
1.55 KB,
text/plain
|
Details |
The following testcase crashes on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 9ca690835a5e (run with --ion-eager): loadFile("\ var findNearestDateBefore = function(start, predicate) {\ var current = start;\ var month = 1000 * 60 * 60 * 24 * 30;\ for (var step = month; step > 0; step = Math.floor(step / 3)) {\ while (!predicate(current))\ current = new Date(current.getTime() + step);\ current = new Date(current.getTime() - step);\ }\ };\ var juneDate = new Date(2000, 5, 20, 0, 0, 0, 0);\ var decemberDate = new Date(2000, 11, 20, 0, 0, 0, 0);\ var juneOffset = juneDate.getTimezoneOffset();\ var decemberOffset = decemberDate.getTimezoneOffset();\ var isSouthernHemisphere = (juneOffset > decemberOffset);\ var winterTime = isSouthernHemisphere ? juneDate : decemberDate;\ var summerTime = isSouthernHemisphere ? decemberDate : juneDate;\ var dstStart = findNearestDateBefore(winterTime, function (date) {\ return date.getTimezoneOffset() == summerTime.getTimezoneOffset();\ })();\ "); loadFile("\ var a = [1];\ function f(x)\ a[2.E3 ] = \"a\";\ for (var i=0; i<550; i++)\ f(i);\ "); function loadFile(lfVarx) { try { if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); } catch (lfVare) { } }
Reporter | ||
Comment 1•11 years ago
|
||
Comment 2•11 years ago
|
||
Stops reproducing with the patch in bug 880816 applied.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•