Closed
Bug 653981
Opened 14 years ago
Closed 14 years ago
TI: Crash [@ js::mjit::EnterMethodJIT]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 653980
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(1 file)
212 bytes,
text/plain
|
Details |
function g(code) {
var wtt = {}
try {
f = eval("(function(){" + code + "})")()
} catch(r) {}
if (wtt.c) {}
}
for (var i = 0; i < 9; i++) {
g("")
}
g("gc()(*)")
crashes js debug shell on JM changeset 9723b731e828 with -m, -a and -n at js::mjit::EnterMethodJIT when the testcase is passed in as a CLI argument to the shell.
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 68286:b40247ae7dd5
user: Brian Hackett
date: Tue Apr 26 22:07:52 2011 -0700
summary: [INFER] Rejoin from recompilations triggered by CompileFunction, bug 646267.
Updated•14 years ago
|
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Updated•14 years ago
|
Crash Signature: [@ js::mjit::EnterMethodJIT]
Comment 2•12 years ago
|
||
A testcase for this bug was already added in the original bug (bug 653980).
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•