674722 - IonMonkey: Segmentation fault in IonBuilder::processDoWhileBodyEnd on null MBasicBlock

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andrew Drake [:adrake]]

Attachment: Test case

Attached test case crashes on x86 debug builds.

Comment 1

[Hannes Verschore [:h4writer]]

Is the same as:

function f() {
   do {
      break;
   } while(0)
}

Looking into it now

Comment 2

[Andrew Drake [:adrake]]

This may be related to bug 674772? Both seem like bookkeeping issues.

Comment 3

[Hannes Verschore [:h4writer]]

Attachment: Patch

Occurred when all paths had break statements in a do-while loop. So is not related with bug #674772

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 549070 [details] [diff] [review]
Patch

Review of attachment 549070 [details] [diff] [review]:
-----------------------------------------------------------------

Comment 5

[Hannes Verschore [:h4writer]]

http://hg.mozilla.org/projects/ionmonkey/rev/6bfa39c5854a