1063297 - Crash [@ AdjustTruncatedInputs]

Status: RESOLVED DUPLICATE of bug 1062612

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 776fa9cf70cd (run with --no-threads --fuzzing-safe):


setJitCompilerOption("baseline.usecount.trigger", 10);
function f(i) {
  if (i == 0) 
    throw testcase ? i++ : NaN;   
  return i*f(i-1);
}
f();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Null-deref, could be a dup of bug 1062612. Let's see what bisection says.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision db7212847c14).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/61f05ae95aa4
user:        Dan Gohman
date:        Tue Sep 02 13:01:31 2014 -0700
summary:     Bug 1054972 - IonMonkey: Truncation for phis r=nbp

This iteration took 397.260 seconds to run.

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/36461117c5aa
user:        Dan Gohman
date:        Thu Sep 04 08:04:34 2014 -0700
summary:     Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands r=nbp

This iteration took 348.376 seconds to run.

Comment 4

[Robert Kaiser]

So, does this mean this is another dupe?