724798 - IonMonkey: Crash [@ js::ion::IonCommonFrameLayout::returnAddress] or [@ js::ion::IonFrameIterator::operator++]

Status: RESOLVED DUPLICATE of bug 724579

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

a = []
b = this
function f(o) {
    __proto__ = a
}
for (;;) {
    try {
        new {}
    } catch (e) {}
    f(b)
}

crashes js debug shell on IonMonkey changeset f46cfb199e77 with -m, -a, --ion and -n at js::ion::IonCommonFrameLayout::returnAddress and crashes js opt shell at js::ion::IonFrameIterator::operator++

Comment 1

[Christian Holler (:decoder)]

This crash is also a test failure of this test:

js/src/tests/js1_2/Array/splice1.js (--ion -n -m)