1528818 - MOZ_CRASH(LIRGenerator::visitLoadElementFromState: Unsupported element type.) with BigInt

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[André Bargull [:anba]]

Test case:

function getarg(x) {
    return arguments[x]
}
function f() {
    var r = 0n;
    for (var i=0;i<2000;++i) {
        r += getarg(1+(i & 1), BigInt(0), 1n);
    }
    return r;
}
for (var i=0;i<2;++i) print(f())

Crashes with:

Hit MOZ_CRASH(LIRGenerator::visitLoadElementFromState: Unsupported element type.) at /home/andre/git/mozilla-central/js/src/jit/Lowering.cpp:3186

in js::jit::LIRGenerator::visitLoadElementFromState.

Comment 1

[Andy Wingo [:wingo]]

Attachment: Bug 1528818 - Fix Ion loading bigint from arguments object

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/22c882a23231
Fix Ion loading bigint from arguments object r=jandem

Comment 3

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/22c882a23231