Closed Bug 914141 Opened 8 years ago Closed 8 years ago

Crash [@ js::Shape::isNative] with backtracking register allocation

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: decoder, Assigned: sunfish)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

The following testcase crashes on mozilla-central revision c7cc85e13f7a (threadsafe build, run with --fuzzing-safe --ion-regalloc=backtracking):


function my_iterator_next() {}
function testCustomIterator() {
  var o = {
    __iterator__: function () {
      return {
        next: my_iterator_next,
      };
    }
  };
  var a=2.0 | this && this && 'x';
  for (var k = 0; k < 100; k += 10)
    for(var j in o)
      a[k + (j >> 0)] = j*k;
}
testCustomIterator()
Needinfo from Brian because it involves the backtracking register allocator :)
Flags: needinfo?(bhackett1024)
Blocks: 826741
This bug was also fixed by the fix for bug 906858.
Assignee: general → sunfish
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Depends on: 906858
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.