All users were logged out of Bugzilla on October 13th, 2018

Crash [@ js::Shape::isNative] with backtracking register allocation

RESOLVED FIXED in mozilla28

Status

()

--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: sunfish)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
mozilla28
x86
Linux
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase crashes on mozilla-central revision c7cc85e13f7a (threadsafe build, run with --fuzzing-safe --ion-regalloc=backtracking):


function my_iterator_next() {}
function testCustomIterator() {
  var o = {
    __iterator__: function () {
      return {
        next: my_iterator_next,
      };
    }
  };
  var a=2.0 | this && this && 'x';
  for (var k = 0; k < 100; k += 10)
    for(var j in o)
      a[k + (j >> 0)] = j*k;
}
testCustomIterator()
(Reporter)

Comment 1

5 years ago
Created attachment 801561 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 2

5 years ago
Needinfo from Brian because it involves the backtracking register allocator :)
Flags: needinfo?(bhackett1024)
(Assignee)

Updated

5 years ago
Blocks: 826741
(Assignee)

Comment 3

5 years ago
This bug was also fixed by the fix for bug 906858.
Assignee: general → sunfish
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
(Assignee)

Updated

5 years ago
Depends on: 906858
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.