642324 - TI: Crash on large test case

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

The test case in bug 591631 doesn't seem to work on the TI branch:

dvander@dvander:~/mozilla/jaegermonkey/js/src$ ./Opt32/js -m fft.js 
fft.js:11461: TypeError: real is undefined
dvander@dvander:~/mozilla/jaegermonkey/js/src$ ./Opt32/js -m -n fft.js 
Segmentation fault

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Reduced

This reduced test case fails with -m -a:

test.js:56: TypeError: spectrum is undefined

Comment 2

[Jan de Mooij [:jandem]]

This may be related to bug 642569, the test case there also fails with -m -a when using > 50 locals.

Comment 3

[Jan de Mooij [:jandem]]

This works perfect now with -m and -m -n, I'm sure bug 642569 fixed it.

There are serious FrameState performance issues though, like the ones dvander fixed in bug 591836. Will file a followup bug.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to comment #3)
> This works perfect now with -m and -m -n, I'm sure bug 642569 fixed it.
> 
> There are serious FrameState performance issues though, like the ones dvander
> fixed in bug 591836. Will file a followup bug.

These will be addressed in bug 638210