Closed Bug 649689 Opened 9 years ago Closed 9 years ago

TI+JM: crash in mjit generated code

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file, 1 obsolete file)

--
function f(x) {
    eval("a = 3");
    x.p = x.p = a;
}
f({p: 2});
--
Crashes with -n -m -a at revision 14d8f4d01296.
Attached patch Patch (obsolete) — Splinter Review
FrameState::storeTo was clobbering the address register. I considered adding a class to pin registers but I think it's better to leave it to someone more experienced with FrameState.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #525755 - Flags: review?(bhackett1024)
Attached patch PatchSplinter Review
Argh, forgot to hg qref the test.
Attachment #525755 - Attachment is obsolete: true
Attachment #525755 - Flags: review?(bhackett1024)
Attachment #525759 - Flags: review?(bhackett1024)
Attachment #525759 - Flags: review?(bhackett1024) → review+
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.