880840 - GenerationalGC: Crash [@ GetGCThingRuntime] or Opt-Crash [@ getClass]

Status: RESOLVED DUPLICATE of bug 880816

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 9ca690835a5e (run with --ion-eager):


loadFile("\
var findNearestDateBefore = function(start, predicate) {\
        var current = start;\
        var month = 1000 * 60 * 60 * 24 * 30;\
        for (var step = month; step > 0; step = Math.floor(step / 3)) {\
                while (!predicate(current))\
                    current = new Date(current.getTime() + step);\
                    current = new Date(current.getTime() - step);\
        }\
    };\
    var juneDate = new Date(2000, 5, 20, 0, 0, 0, 0);\
    var decemberDate = new Date(2000, 11, 20, 0, 0, 0, 0);\
    var juneOffset = juneDate.getTimezoneOffset();\
    var decemberOffset = decemberDate.getTimezoneOffset();\
    var isSouthernHemisphere = (juneOffset > decemberOffset);\
    var winterTime = isSouthernHemisphere ? juneDate : decemberDate;\
    var summerTime = isSouthernHemisphere ? decemberDate : juneDate;\
   var dstStart = findNearestDateBefore(winterTime, function (date) {\
        return date.getTimezoneOffset() == summerTime.getTimezoneOffset();\
})();\
");
loadFile("\
var a = [1];\
function f(x)\
  a[2.E3 ] = \"a\";\
for (var i=0; i<550; i++)\
    f(i);\
");
function loadFile(lfVarx) {
    try {
      if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) 
         function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); 
    } catch (lfVare) {    }
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Terrence Cole [:terrence]]

Stops reproducing with the patch in bug 880816 applied.