618024 - JM shell crashes on the attached test case

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Test case

JM-only crash in debug and release builds.

Debug build (x32, OS X) crashes with: Trace/BPT trap
Release build: Segmentation fault

Comment 1

[Jan de Mooij [:jandem]]

(In reply to comment #0)
> x32
Ehm x86 or 32-bit...

I can't get this to crash in the browser; might be shell only.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

This sounds like a memory management bug with recompilation.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

First, a little explanation about setDebug: it's a hack. Debug mode requires that no scripts are live (jsd respects this). But that would prevent us from testing debug mode, so we expose the ability to flip it on, in the shell, from within a script.

As long as it's the first line in the file, it'll work. Otherwise, you run the risk of building a call IC, which may become invalid if that call is recompiled.

That's exactly what happened here. The debugger test cases are special and may not survive concatenation with other shell tests.