758181 - IonMonkey: Crash [@ js::ion::MNode::block] or [@ js::ion::Loop::isInLoop]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

I get this crash a lot in the browser, below is a reduced testcase.

function Ld(a) {
    var sum = 0;
    for (var d = 5; 0 <= d; d--)
        sum += a[d];
    return sum;
}

var arr = [0, 1, 2, 3, 4, 5, 6];

for (var i=0; i < 50; i++)
    assertEq(Ld(arr), 15);

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

We're missing a NULL check in tryHoistBoundsCheck. The loop condition is "0 <= d" and in this case LinearSum::term is NULL. I don't know this function very well though, so please double-check.

Comment 2

[Jan de Mooij [:jandem]]

Thanks for the fast review.

https://hg.mozilla.org/projects/ionmonkey/rev/d99898b8c8fe