Closed Bug 655699 Opened 13 years ago Closed 13 years ago

TI: Crash [@ js::mjit::EnterMethodJIT]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

[[]] = [, []]

crashes js opt and debug shell on JM changeset 3062ff7fef83 with -m, -a and -n at js::mjit::EnterMethodJIT

Related to bug 655507 ?
Tested on 64-bit.
Yeah, I think this is the same bug.  Just ran into this myself fixing x64 jit-tests for the interpoline bug, will push the fix as part of that patch (then confirm here).  The problem is that a recent change to array accesses (don't allocate an extra register when all it is needed for is a hole check) was broken on x64.
WFM now, fixed I think as part of rev c963b24694cd.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ js::mjit::EnterMethodJIT]
You need to log in before you can comment on or make changes to this bug.