Last Comment Bug 758181 - IonMonkey: Crash [@ js::ion::MNode::block] or [@ js::ion::Loop::isInLoop]
: IonMonkey: Crash [@ js::ion::MNode::block] or [@ js::ion::Loop::isInLoop]
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: IonMonkey
  Show dependency treegraph
 
Reported: 2012-05-24 06:00 PDT by Jan de Mooij [:jandem]
Modified: 2012-05-24 07:31 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (1.62 KB, patch)
2012-05-24 06:08 PDT, Jan de Mooij [:jandem]
bhackett1024: review+
Details | Diff | Splinter Review

Description Jan de Mooij [:jandem] 2012-05-24 06:00:54 PDT
I get this crash a lot in the browser, below is a reduced testcase.

function Ld(a) {
    var sum = 0;
    for (var d = 5; 0 <= d; d--)
        sum += a[d];
    return sum;
}

var arr = [0, 1, 2, 3, 4, 5, 6];

for (var i=0; i < 50; i++)
    assertEq(Ld(arr), 15);
Comment 1 Jan de Mooij [:jandem] 2012-05-24 06:08:43 PDT
Created attachment 626776 [details] [diff] [review]
Patch

We're missing a NULL check in tryHoistBoundsCheck. The loop condition is "0 <= d" and in this case LinearSum::term is NULL. I don't know this function very well though, so please double-check.
Comment 2 Jan de Mooij [:jandem] 2012-05-24 07:31:05 PDT
Thanks for the fast review.

https://hg.mozilla.org/projects/ionmonkey/rev/d99898b8c8fe

Note You need to log in before you can comment on or make changes to this bug.