TI: Crash [@ JSObject::getProto]

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Trunk
x86_64
Linux
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

6 years ago
The following testcase crashes on jaegermonkey revision 07c668448519 (run with -m -n -a), tested on 64 bit:


function name(v) {}
function testContinue() {
    for (i = 0; i < 20; ++(name)) {
        if ([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
            continue;
    }
}
assertEq(testContinue(), 19);
Ah, noticed this yesterday but didn't fix it.  Array initializers are only inlined when all elements fit in the object's fixed slots, but the test for this did not account for the ObjectElements header added by bug 693221.

https://hg.mozilla.org/projects/jaegermonkey/rev/ae061e27e3df
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Comment 2

5 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.