Note: There are a few cases of duplicates in user autocompletion which are being worked on.

IonMonkey: Crash [@ js::ion::MNode::block] or [@ js::ion::Loop::isInLoop]

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
I get this crash a lot in the browser, below is a reduced testcase.

function Ld(a) {
    var sum = 0;
    for (var d = 5; 0 <= d; d--)
        sum += a[d];
    return sum;
}

var arr = [0, 1, 2, 3, 4, 5, 6];

for (var i=0; i < 50; i++)
    assertEq(Ld(arr), 15);
(Assignee)

Comment 1

5 years ago
Created attachment 626776 [details] [diff] [review]
Patch

We're missing a NULL check in tryHoistBoundsCheck. The loop condition is "0 <= d" and in this case LinearSum::term is NULL. I don't know this function very well though, so please double-check.
Attachment #626776 - Flags: review?(bhackett1024)
Attachment #626776 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 2

5 years ago
Thanks for the fast review.

https://hg.mozilla.org/projects/ionmonkey/rev/d99898b8c8fe
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.