Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 15 years ago

(function(){
  (x)=<x>></x>
})()
try{
  (function(){
    ((function a(aaaaaa,bbbbbb){
      if(aaaaaa.length==bbbbbb){
        return eval%bbbbbb.valueOf()
      }
      cccccc=a(aaaaaa,bbbbbb+1)
      return cccccc._=x
    })([,,,,,,,,,,,,,,,,,,0],0))
  })()
}catch(e){}


asserts 64-bit js debug shell on JM tip with -m at Assertion failure: cx->throwing, at ../methodjit/Stubs.cpp:3231

This seems to occur as far back as this changeset:

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/cb99898f20a5

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 1 • 15 years ago

OOM and E4X. Nice combination.

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/f054abe132ef

	Christian Holler (:decoder)
	Comment 2 • 12 years ago

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug553784.js.