843429 - BaselineCompiler: Crash [@ JSObject::defaultValue]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function () {
    const x = [] = {};
    (function () {
        print(x)
    })()
})()

crashes js debug and opt shell on ionmonkey changeset 2445c6378f36 without any CLI arguments at JSObject::defaultValue

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I tested this on 32-bit Linux.

Comment 3

[Christian Holler (:decoder)]

Yep, confirmed. It doesn't reproduce on 64 bit that's why JSBugMon failed.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Reproduces on 32-bit Mac.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   121322:f21ddc17c570
user:        Brian Hackett
date:        Thu Feb 07 13:03:12 2013 -0700
summary:     Bug 839080 - Compile object initializer opcodes, r=djvj.

Brian, is bug 839080 a likely regressor?

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Patch

Between ops, values on top of the stack can be in R0 or R1 and SETALIASEDVAR shouldn't use these registers.

Comment 7

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/de894e57ecb2