Closed
Bug 606063
Opened 14 years ago
Closed 14 years ago
JM: Register allocation bug in LSH
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: dvander, Assigned: dvander)
References
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
1.58 KB,
patch
|
dmandelin
:
review+
|
Details | Diff | Splinter Review |
This is very old code, and somehow didn't hit until I started rewriting the GETELEM path, which was failing deep in v8-crypto. After a few wild goose chases, the problem is that the LSH path does: tempRegForData(x) copyDataIntoReg(y) The second allocation can clobber the first. The attached test case is for an edge condition, I didn't try to test case the actual bug, which only manifested with my patch queue.
Assignee | ||
Comment 1•14 years ago
|
||
Attachment #484932 -
Flags: review?(dmandelin)
Updated•14 years ago
|
Attachment #484932 -
Flags: review?(dmandelin) → review+
Assignee | ||
Comment 2•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/54a03edfa919
Whiteboard: fixed-in-tracemonkey
Comment 3•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/54a03edfa919
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•