Closed Bug 1104816 Opened 11 years ago Closed 11 years ago

crash in js::jit::LinearScanAllocator::assign(js::jit::LAllocation)

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Version:
36 Branch
Platform:
x86
Windows NT
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox35 --- unaffected
firefox36 --- affected

People

(Reporter: alice0775, Unassigned)

Details

(Keywords: crash, regression, Whiteboard: [Dupe me])

Crash Data

This bug was filed from the Socorro interface and is report bp-6e42537a-ad87-4704-a83e-0cef32141125. ============================================================= STR 1. Install Gecho Profier 1.14.2 2. Open http://www.colorful-hp.net/archive/entry-927.html Actual Results: Crash Regression window(m-i) Good: https://hg.mozilla.org/integration/mozilla-inbound/rev/2d8d27914945 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 ID:20141119163007 Bad: https://hg.mozilla.org/integration/mozilla-inbound/rev/43aceb996c3b Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 ID:20141119165203 Pushlog: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=2d8d27914945&tochange=43aceb996c3b Regressed by: 43aceb996c3b Hannes Verschore — Bug 1101576 - IonMonkey: Add fixes for LSubstr, r=efaust
Keywords: regression
no longer crash Fixed range https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=bca4892bbe03&tochange=ced1402861b8 Fixed by: 0164b161e0d8 Hannes Verschore — Bug 1103032: IonMonkey: Get LSubstr working with limited amount of available registers, r=jandem
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.