Closed
Bug 649689
Opened 13 years ago
Closed 13 years ago
TI+JM: crash in mjit generated code
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file, 1 obsolete file)
2.69 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
-- function f(x) { eval("a = 3"); x.p = x.p = a; } f({p: 2}); -- Crashes with -n -m -a at revision 14d8f4d01296.
Assignee | ||
Comment 1•13 years ago
|
||
FrameState::storeTo was clobbering the address register. I considered adding a class to pin registers but I think it's better to leave it to someone more experienced with FrameState.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #525755 -
Flags: review?(bhackett1024)
Assignee | ||
Comment 2•13 years ago
|
||
Argh, forgot to hg qref the test.
Attachment #525755 -
Attachment is obsolete: true
Attachment #525755 -
Flags: review?(bhackett1024)
Attachment #525759 -
Flags: review?(bhackett1024)
Updated•13 years ago
|
Attachment #525759 -
Flags: review?(bhackett1024) → review+
Updated•13 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•