850099 - BaselineCompiler: Assertion failure: isStackSlot(), at ../ion/LIR-inl.h:38

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on baseline compiler branch revision b942f88d95c5 (run with --ion-eager):


var buf = serialize(-1);
var nbuf = serialize(undefined);
for (var j = 0 ; j < 1; j++)
  buf[j + 8] = nbuf[j];

Comment 1

[Christian Holler (:decoder)]

Marking s-s since baseline will land soon and this is a security issue. Opt builds crash in various ways where the debug build hits this assertion.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

Small fix for StoreTypedArrayElementHole to handle the case where the length is constant but the index is not.

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/607291e864e3

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.