If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash [@ AdjustTruncatedInputs]

RESOLVED DUPLICATE of bug 1062612

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 1062612
3 years ago
3 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
x86_64
Linux
crash, testcase
Points:
---

Firefox Tracking Flags

(firefox35 affected)

Details

(Whiteboard: [jsbugmon:update,ignore], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
The following testcase crashes on mozilla-central revision 776fa9cf70cd (run with --no-threads --fuzzing-safe):


setJitCompilerOption("baseline.usecount.trigger", 10);
function f(i) {
  if (i == 0) 
    throw testcase ? i++ : NaN;   
  return i*f(i-1);
}
f();
(Reporter)

Comment 1

3 years ago
Created attachment 8484700 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 2

3 years ago
Null-deref, could be a dup of bug 1062612. Let's see what bisection says.
status-firefox35: --- → affected
Whiteboard: [jsbugmon:update,bisect,bisectfix]
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,ignore]
(Reporter)

Comment 3

3 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision db7212847c14).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/61f05ae95aa4
user:        Dan Gohman
date:        Tue Sep 02 13:01:31 2014 -0700
summary:     Bug 1054972 - IonMonkey: Truncation for phis r=nbp

This iteration took 397.260 seconds to run.

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/36461117c5aa
user:        Dan Gohman
date:        Thu Sep 04 08:04:34 2014 -0700
summary:     Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands r=nbp

This iteration took 348.376 seconds to run.

Comment 4

3 years ago
So, does this mean this is another dupe?

Updated

3 years ago
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1062612
You need to log in before you can comment on or make changes to this bug.