Closed Bug 1528818 Opened 1 year ago Closed 1 year ago

MOZ_CRASH(LIRGenerator::visitLoadElementFromState: Unsupported element type.) with BigInt

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox67 --- fixed

People

(Reporter: anba, Assigned: wingo)

References

Details

Attachments

(1 file)

Test case:

function getarg(x) {
    return arguments[x]
}
function f() {
    var r = 0n;
    for (var i=0;i<2000;++i) {
        r += getarg(1+(i & 1), BigInt(0), 1n);
    }
    return r;
}
for (var i=0;i<2;++i) print(f())

Crashes with:

Hit MOZ_CRASH(LIRGenerator::visitLoadElementFromState: Unsupported element type.) at /home/andre/git/mozilla-central/js/src/jit/Lowering.cpp:3186

in js::jit::LIRGenerator::visitLoadElementFromState.

Keywords: checkin-needed

Pushed by dluca@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/22c882a23231
Fix Ion loading bigint from arguments object r=jandem

Keywords: checkin-needed
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.