Crash [@ js::CompartmentChecker::check] or Opt-Crash [@ js::ToNumberSlow] with backtracking register allocation

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
5 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
x86
Linux
crash, testcase
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase crashes on mozilla-central revision c7cc85e13f7a (run with --ion-regalloc=backtracking):


function test() {
    var ival = 0 ^ this && this;
    for (var i = 0; i < 30000; i++) {
        ival -= 200000;
    }
    return (ival > -2147483648);
} test();
(Reporter)

Updated

5 years ago
Flags: needinfo?(bhackett1024)
Summary: Crash [@ js::CompartmentChecker::check] or Opt-Crash [@ js::ToNumberSlow] → Crash [@ js::CompartmentChecker::check] or Opt-Crash [@ js::ToNumberSlow] with backtracking register allocation
(Reporter)

Comment 1

5 years ago
Created attachment 801627 [details]
[crash-signature] Machine-readable crash signature
This doesn't crash for me on either x86 or x64.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → WORKSFORME
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.