Closed
Bug 906885
Opened 11 years ago
Closed 11 years ago
Crash with SIGTRAP involving --ion-check-range-analysis
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla26
People
(Reporter: gkw, Assigned: sunfish)
References
Details
(Keywords: crash, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
|
200 bytes,
text/plain
|
Details | |
|
2.61 KB,
patch
|
nbp
:
review+
|
Details | Diff | Splinter Review |
ParallelArray([57], function() {
return (Math.max(2207764374, (function() {
return 1
})()))
})
causes a SIGTRAP in 64-bit debug threadsafe js debug shell on m-i changeset af93c819008e with --ion-check-range-analysis
This may be related to bug 894813, and the mozilla-inbound changeset listed contains the latest fixes there.Flags: needinfo?(sunfish)
|
Assignee | |
Comment 1•11 years ago
|
||
The code in Range::max etc. assumes that isUpperInfinite() or isLowerInfinite() would imply isInfinite(). It turns out they don't. This patch fixes it.
Assignee: general → sunfish
Attachment #792474 -
Flags: review?(nicolas.b.pierron)
Flags: needinfo?(sunfish)
|
||
Updated•11 years ago
|
Attachment #792474 -
Flags: review?(nicolas.b.pierron) → review+
|
|
Assignee | |
Comment 2•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/86074c80a35a
|
||
Comment 3•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/86074c80a35a
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
You need to log in
before you can comment on or make changes to this bug.
Description
•