JM shell crashes on the attached test case

RESOLVED WONTFIX

Status

()

Core
JavaScript Engine
RESOLVED WONTFIX
8 years ago
7 years ago

People

(Reporter: jandem, Assigned: dvander)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:nse])

Attachments

(1 attachment)

633 bytes, application/x-javascript
Details
(Reporter)

Description

8 years ago
Created attachment 496545 [details]
Test case

JM-only crash in debug and release builds.

Debug build (x32, OS X) crashes with: Trace/BPT trap
Release build: Segmentation fault
Assignee: general → dvander
Status: NEW → ASSIGNED
(Reporter)

Comment 1

8 years ago
(In reply to comment #0)
> x32
Ehm x86 or 32-bit...

I can't get this to crash in the browser; might be shell only.
Blocks: 536277
This sounds like a memory management bug with recompilation.
blocking2.0: --- → final+
First, a little explanation about setDebug: it's a hack. Debug mode requires that no scripts are live (jsd respects this). But that would prevent us from testing debug mode, so we expose the ability to flip it on, in the shell, from within a script.

As long as it's the first line in the file, it'll work. Otherwise, you run the risk of building a call IC, which may become invalid if that call is recompiled.

That's exactly what happened here. The debugger test cases are special and may not survive concatenation with other shell tests.
Status: ASSIGNED → RESOLVED
blocking2.0: final+ → ---
Last Resolved: 8 years ago
Resolution: --- → WONTFIX

Updated

8 years ago
OS: Mac OS X → Windows 7
Summary: JM crashes on the attached test case → JM shell crashes on the attached test case
Whiteboard: [sg:nse]

Updated

8 years ago
OS: Windows 7 → Mac OS X
Group: core-security
You need to log in before you can comment on or make changes to this bug.