TI+JM: crash in mjit generated code

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

--
function f(x) {
    eval("a = 3");
    x.p = x.p = a;
}
f({p: 2});
--
Crashes with -n -m -a at revision 14d8f4d01296.
Posted patch Patch (obsolete) — Splinter Review
FrameState::storeTo was clobbering the address register. I considered adding a class to pin registers but I think it's better to leave it to someone more experienced with FrameState.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #525755 - Flags: review?(bhackett1024)
Posted patch PatchSplinter Review
Argh, forgot to hg qref the test.
Attachment #525755 - Attachment is obsolete: true
Attachment #525755 - Flags: review?(bhackett1024)
Attachment #525759 - Flags: review?(bhackett1024)
Attachment #525759 - Flags: review?(bhackett1024) → review+
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.