Last Comment Bug 693971 - TI: Crash [@ JSObject::getProto]
: TI: Crash [@ JSObject::getProto]
Status: RESOLVED FIXED
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
 
Reported: 2011-10-12 04:41 PDT by Christian Holler (:decoder)
Modified: 2013-01-19 14:20 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2011-10-12 04:41:54 PDT
The following testcase crashes on jaegermonkey revision 07c668448519 (run with -m -n -a), tested on 64 bit:


function name(v) {}
function testContinue() {
    for (i = 0; i < 20; ++(name)) {
        if ([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
            continue;
    }
}
assertEq(testContinue(), 19);
Comment 1 Brian Hackett (:bhackett) 2011-10-13 09:21:28 PDT
Ah, noticed this yesterday but didn't fix it.  Array initializers are only inlined when all elements fit in the object's fixed slots, but the test for this did not account for the ObjectElements header added by bug 693221.

https://hg.mozilla.org/projects/jaegermonkey/rev/ae061e27e3df
Comment 2 Christian Holler (:decoder) 2013-01-19 14:20:41 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.