Closed
Bug 765313
Opened 12 years ago
Closed 12 years ago
script->types is getting thrown out too soon in JSScript::ensureRanAnalysis
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla16
People
(Reporter: billm, Assigned: billm)
Details
(Whiteboard: [js:t])
Attachments
(1 file)
|
770 bytes,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
The problem is that we call script->ensureHasTypes at the top of JSScript::ensureRanAnalysis. A little later, we call something that expects script->types to be non-NULL. If we GC in the middle, we get failures. I found this while running with GC zeal. This may or may not be the right fix, but it worked for me.
Attachment #633588 -
Flags: review?(bhackett1024)
|
||
Updated•12 years ago
|
Attachment #633588 -
Flags: review?(bhackett1024) → review+
|
||
Updated•12 years ago
|
Whiteboard: [js:t]
|
Assignee | |
Comment 1•12 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/868fd5e81dd7
Target Milestone: --- → mozilla16
|
||
Comment 2•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/868fd5e81dd7
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•