Closed Bug 658212 Opened 13 years ago Closed 13 years ago

TI: Crash [@ JSString::length]

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 658211

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

The attached testcase crashes on TI revision 4dff743ec04d (run with -j -m -n -a), tested on 64 bit.

Backtrace:

==19388== Invalid read of size 8
==19388==    at 0x43943E: JSString::length() const (jsstr.h:250)
==19388==    by 0x505D2A: bool js::StringToNumberType<double>(JSContext*, JSString*, double*) (jsnum.h:646)
==19388==    by 0x50538F: js::ValueToNumberSlow(JSContext*, js::Value, double*) (jsnum.cpp:1292)
==19388==    by 0x50696B: js::ValueToNumber(JSContext*, js::Value*) (jsnum.h:280)
==19388==    by 0x799619: js::mjit::stubs::Pos(js::VMFrame&) (StubCalls.cpp:2581)
==19388==    by 0x41B1C73: ???
==19388==    by 0x6914BC: js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, js::Value*) (MethodJIT.cpp:882)
==19388==    by 0x69162C: CheckStackAndEnterMethodJIT(JSContext*, js::StackFrame*, void*) (MethodJIT.cpp:914)
==19388==    by 0x691708: js::mjit::JaegerShot(JSContext*) (MethodJIT.cpp:931)
==19388==    by 0x77E6DA: js::Interpret(JSContext*, js::StackFrame*, unsigned int, js::InterpMode) (jsinterp.cpp:4727)
==19388==    by 0x735E8C: js_InternalInterpret (InvokeHelpers.cpp:1636)
==19388==    by 0x6911E1: ??? (MethodJIT.cpp:152)
==19388==  Address 0x5 is not stack'd, malloc'd or (recently) free'd
==19388== 
==19388== 
==19388== Process terminating with default action of signal 11 (SIGSEGV)
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ JSString::length]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/recompile/bug658212.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: