914141 - Crash [@ js::Shape::isNative] with backtracking register allocation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision c7cc85e13f7a (threadsafe build, run with --fuzzing-safe --ion-regalloc=backtracking):


function my_iterator_next() {}
function testCustomIterator() {
  var o = {
    __iterator__: function () {
      return {
        next: my_iterator_next,
      };
    }
  };
  var a=2.0 | this && this && 'x';
  for (var k = 0; k < 100; k += 10)
    for(var j in o)
      a[k + (j >> 0)] = j*k;
}
testCustomIterator()

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Needinfo from Brian because it involves the backtracking register allocator :)

Comment 3

[Dan Gohman [:sunfish]]

This bug was also fixed by the fix for bug 906858.