648999 - TI: Crash in mjit-generated code

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on TI revision 74a8fb1bbec5 (run with -m -n -a), tested on 64 bit:

test();
function test()
{
  for (var j = 0; j < 10; ++j) new j;
}

Comment 1

[Brian Hackett [Laid off!]]

If the called function is a known primitive but a copy of something else, we tried to forget its type but screwed that up, and didn't generate a test for an object later.  Comments: syncAndForgetFe should forget if the fe is a copy (need to look at its other calls), and we should assert when trying to write the data/type info for entries which are copies of other entries (added asserts recently if we read this info).

http://hg.mozilla.org/projects/jaegermonkey/rev/265baede77e3

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929