The default bug view has changed. See this FAQ.

TI+JM: crash in mjit generated code

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

6 years ago
--
function f(x) {
    eval("a = 3");
    x.p = x.p = a;
}
f({p: 2});
--
Crashes with -n -m -a at revision 14d8f4d01296.
(Assignee)

Comment 1

6 years ago
Created attachment 525755 [details] [diff] [review]
Patch

FrameState::storeTo was clobbering the address register. I considered adding a class to pin registers but I think it's better to leave it to someone more experienced with FrameState.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #525755 - Flags: review?(bhackett1024)
(Assignee)

Comment 2

6 years ago
Created attachment 525759 [details] [diff] [review]
Patch

Argh, forgot to hg qref the test.
Attachment #525755 - Attachment is obsolete: true
Attachment #525755 - Flags: review?(bhackett1024)
Attachment #525759 - Flags: review?(bhackett1024)
Attachment #525759 - Flags: review?(bhackett1024) → review+
http://hg.mozilla.org/projects/jaegermonkey/rev/a3eeee8f7803
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.