Closed Bug 653981 Opened 10 years ago Closed 10 years ago

TI: Crash [@ js::mjit::EnterMethodJIT]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 653980

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

stack
212 bytes, text/plain
Details
Attached file stack — 
function g(code) {
    var wtt = {}
    try {
        f = eval("(function(){" + code + "})")()
    } catch(r) {}
    if (wtt.c) {}
}
for (var i = 0; i < 9; i++) {
    g("")
}
g("gc()(*)")

crashes js debug shell on JM changeset 9723b731e828 with -m, -a and -n at js::mjit::EnterMethodJIT when the testcase is passed in as a CLI argument to the shell.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   68286:b40247ae7dd5
user:        Brian Hackett
date:        Tue Apr 26 22:07:52 2011 -0700
summary:     [INFER] Rejoin from recompilations triggered by CompileFunction, bug 646267.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 653980
Crash Signature: [@ js::mjit::EnterMethodJIT]
A testcase for this bug was already added in the original bug (bug 653980).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.