762458 - IonMonkey: Assertion failure: str, at ../../jsval.h:402 or Crash [@ JSString::isAtom]

Status: RESOLVED DUPLICATE of bug 763039

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey-arm (private branch) revision 153a2db06024 (run with --ion -n -m --ion-eager):


var SECTION = "15.5.4.7-1";
var TEST_STRING = new String(" !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~");
for ( k = 9, i = 0x0021; i < 0x007d; i++, j++, k++ )
		LastIndexOf( TEST_STRING, String.fromCharCode(i) +
			     String.fromCharCode(i+1)+String.fromCharCode(i+2), 0),
		TEST_STRING.lastIndexOf( (String.fromCharCode(i)+
					 k ) );
function LastIndexOf( string, search, position ) {
  position = Number( position )
    if ( isNaN( position ) ) {
      position = Infinity;
    }
  result5= string.length;
  result6 = Math.min(Math.max(position, 0), result5);
  result7 = search.length;
  for ( k = 0; k <= result6; (SECTION)++ )
    for ( j = 0; j < result7; j++ )
      if ( string.charAt(k+j) != search.charAt(j) ){
	break;
      }
}

Comment 1

[Marty Rosenberg [:mjrosenb]]

This is actually a bug that exists on x86 as well as ARM.  sstangl has a patch for it.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 763039).