924920 - Crash with SIGTRAP with --ion-regalloc=backtracking combined with other flags

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 64b497e6f593 (threadsafe build, run with --fuzzing-safe --ion-eager --ion-compile-try-catch --ion-check-range-analysis --ion-regalloc=backtracking):


var TIME_2000  = 946684800000;
var TIME_1900  = -2208988800000;
function testx() {
var array = new Array();
array[array.length] = new Date( TIME_2000 * Math.PI );
array[array.length] = new Date( TIME_1900 + TIME_1900  );
array[array.length] = new Date(0);
var stringarr = new Array();
clone( array, stringarr );
stringarr.sort( stringsort );
function clone( source, target ) {
  for (i = 0; i < source.length; i++ ) {
    target[i] = source[i];
  }
}
function stringsort( x, y ) {
  for ( var i = 0; i < x.toString().length; i++ ) {
    var d = (x.toString()).charCodeAt(i) - (y.toString()).charCodeAt(i);
    var d = x.length - y.length;
    if  ( d > 0 ) {    } else {
      if ( d < 0 ) {      }
    }
  }
}
} testx();

Comment 1

[Christian Holler (:decoder)]

I keep seeing SIGTRAPs and I cannot create signatures for those to distinguish them.

Comment 2

[Dan Gohman [:sunfish]]

This was fixed in d0fc1cc4c62b (bug 150875).

Comment 3

[Emanuel Hoogeveen [:ehoogeveen]]

I think you mean bug 925848? (looking at that changeset)

Comment 4

[Dan Gohman [:sunfish]]

Oops, yes.