451813 - TM: double for-loop plus if-statement with var creation crashes JIT in FF3.1a2pre nightly

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[barbarianbob]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.1a2pre) Gecko/20080822033426 Minefield/3.1a2pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.1a2pre) Gecko/20080822033426 Minefield/3.1a2pre

Run a 2d nested for-loop, both setting a new variable with the var keyword. You must have the var keyword:
for(VAR x=0;x<10;x+=1)

Inside both, run an if-statement that references a property of a global object. The loops will quickly crash if JIT is enabled.

Reproducible: Always

Steps to Reproduce:
1. In about:config, set javascript.options.jit.content = true
2. Visit testcase
3. Loops will cause crash
Actual Results:  
Crash

Expected Results:  
64 alert boxes, then exit function

Just installed the nightly on a new profile.

Comment 1

[Andreas Gal :gal]

Tested with current tracemonkey build (tinderbox).