Closed
Bug 583158
Opened 14 years ago
Closed 14 years ago
JM: Crash [@ js::mjit::ic::GetGlobalName] or "Assertion failure: index < atomMap.length,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(4 keywords)
Crash Data
function g() { var rv = (function() { this << 1 })() if (a) function() {} } g() asserts js debug shell on JM changeset 89964b93d40d with -m at Assertion failure: index < atomMap.length, at ../../jsscript.h:292 and crashes js opt shell with -m at js::mjit::ic::GetGlobalName. Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000000 0x001c6bc4 in js::mjit::ic::GetGlobalName () (gdb) bt #0 0x001c6bc4 in js::mjit::ic::GetGlobalName () #1 0x002c63c5 in ?? () #2 0x0018a0b7 in js::mjit::JaegerShot () #3 0x0006ebac in js::Execute () #4 0x000151c8 in JS_ExecuteScript () #5 0x0000611c in Process () #6 0x000099f7 in shell () #7 0x00009f28 in main () (gdb) x/i $eip 0x1c6bc4 <_ZN2js4mjit2ic13GetGlobalNameERNS_7VMFrameEj+68>: mov (%edx,%eax,4),%ecx (gdb) x/b $edx 0x0: Cannot access memory at address 0x0 (gdb) x/b $eax 0x0: Cannot access memory at address 0x0
Updated•13 years ago
|
Crash Signature: [@ js::mjit::ic::GetGlobalName]
Comment 2•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug583158.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•