Closed
Bug 776359
Opened 13 years ago
Closed 13 years ago
Crash with --ion-regalloc=greedy
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WONTFIX
People
(Reporter: jruderman, Unassigned)
References
Details
(Keywords: crash, testcase, Whiteboard: [js:t])
Crash Data
Attachments
(1 file)
|
16.09 KB,
text/plain
|
Details |
./js --ion-eager --ion-regalloc=greedy
var c = {};
c.p = 0.3;
var a = [];
function f(a_) {
a_.k = a.join();
return c.p;
}
f(a);
f(a);
The first bad revision is:
changeset: 8a2010ae3d08
user: Sean Stangl
date: Tue Mar 27 12:20:22 2012 -0700
summary: Bug 735400 - Optimize JSOP_FUNCALL. r=dvander
|
||
Updated•13 years ago
|
Crash Signature: [@ js::EncapsulatedPtr<js::Shape, unsigned long>::operator js::Shape*()]
|
||
Updated•13 years ago
|
Whiteboard: [js:t]
This wasn't supported, so we're just going to remove it since it's a lot of code.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WONTFIX
You need to log in
before you can comment on or make changes to this bug.
Description
•