Closed Bug 1063297 Opened 10 years ago Closed 10 years ago

Crash [@ AdjustTruncatedInputs]

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1062612
Tracking Status
firefox35 --- affected

People

(Reporter: decoder, Unassigned)

Details

(Keywords: crash, testcase, Whiteboard: [jsbugmon:update,ignore])

Crash Data

Attachments

(1 file)

The following testcase crashes on mozilla-central revision 776fa9cf70cd (run with --no-threads --fuzzing-safe): setJitCompilerOption("baseline.usecount.trigger", 10); function f(i) { if (i == 0) throw testcase ? i++ : NaN; return i*f(i-1); } f();
Null-deref, could be a dup of bug 1062612. Let's see what bisection says.
Whiteboard: [jsbugmon:update,bisect,bisectfix]
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision db7212847c14). JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/61f05ae95aa4 user: Dan Gohman date: Tue Sep 02 13:01:31 2014 -0700 summary: Bug 1054972 - IonMonkey: Truncation for phis r=nbp This iteration took 397.260 seconds to run. JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/36461117c5aa user: Dan Gohman date: Thu Sep 04 08:04:34 2014 -0700 summary: Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands r=nbp This iteration took 348.376 seconds to run.
So, does this mean this is another dupe?
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: