713952 - IonMonkey: Crash in math-cordic with --ion -n

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

This test currently segfaults with LSRA.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

The bug is a regression from bug 695075. When we re-use a Value slot for a double, we have to compute its base since it could be off by 4 bytes.

Comment 2

[Sean Stangl [:sstangl]]

Comment on attachment 584642 [details] [diff] [review]
fix

Review of attachment 584642 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/C1Spewer.cpp
@@ +55,5 @@
>  
>  bool
>  C1Spewer::init(const char *path)
>  {
> +    spewout_ = fopen(path, "a");

This seems dangerous. We should keep overwriting by default. I will not remember to periodically clear this file manually.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/fb34f17071b4 (w/ fopen change reverted)