Closed
Bug 655699
Opened 15 years ago
Closed 15 years ago
TI: Crash [@ js::mjit::EnterMethodJIT]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase)
Crash Data
[[]] = [, []]
crashes js opt and debug shell on JM changeset 3062ff7fef83 with -m, -a and -n at js::mjit::EnterMethodJIT
Related to bug 655507 ?
|
Reporter | |
Comment 1•15 years ago
|
||
Tested on 64-bit.
|
||
Comment 2•15 years ago
|
||
Yeah, I think this is the same bug. Just ran into this myself fixing x64 jit-tests for the interpoline bug, will push the fix as part of that patch (then confirm here). The problem is that a recent change to array accesses (don't allocate an extra register when all it is needed for is a hole check) was broken on x64.
|
|
||
Comment 3•15 years ago
|
||
WFM now, fixed I think as part of rev c963b24694cd.
|
|
||
Updated•15 years ago
|
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
|
||
Updated•15 years ago
|
Crash Signature: [@ js::mjit::EnterMethodJIT]
You need to log in
before you can comment on or make changes to this bug.
Description
•