Closed
Bug 449666
Opened 17 years ago
Closed 17 years ago
TM: Assertion failure: JSSTRING_IS_FLAT during trace recording
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: sayrer, Assigned: sayrer)
References
()
Details
(Keywords: assertion, testcase)
Attachments
(4 files)
Hitting this on blogspot.com blogs
Assignee | ||
Comment 1•17 years ago
|
||
Assignee | ||
Comment 2•17 years ago
|
||
Assignee | ||
Comment 3•17 years ago
|
||
Assignee | ||
Updated•17 years ago
|
Attachment #332809 -
Attachment mime type: application/x-javascript → text/plain
Comment 4•17 years ago
|
||
We have some parts that require flat strings, but they should be guarded, and I wouldn't expect to see quite that stack.
Comment 5•17 years ago
|
||
Easy to fix: tracer needs to js_InternNonIntElementId (as interpreter JSOP_GETELEM case code will shortly -- so tracer should update the stack slot to save a redundant intern'ing). Anyone want to grab this, it's easy?
/be
Updated•17 years ago
|
Assignee | ||
Comment 6•17 years ago
|
||
Attachment #333103 -
Flags: review?(brendan)
Comment 7•17 years ago
|
||
Comment on attachment 333103 [details] [diff] [review]
fix
>+ JSObject *obj = JSVAL_TO_OBJECT(l);
>+
>+ if (!js_InternNonIntElementId(cx, obj, r, &id))
>+ return false;
Looks good, only thought is to cut through the E4X fog by calling js_ValueToStringId instead (js_InternNonIntElementId takes obj only to check whether it's XML, and if not just calls js_ValueToStringId). We know r is a string here, not an object (not a QName, an E4X compound identifier). Modularity is secondary both given how tight the tracer is with the interpreter, and because we have weeded out non-string r cases already.
r=me with that if you buy it, else as is.
/be
Attachment #333103 -
Flags: review?(brendan) → review+
Assignee | ||
Updated•17 years ago
|
Assignee: general → sayrer
Assignee | ||
Comment 8•17 years ago
|
||
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Comment 9•16 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/422f9867bff9
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-449666.js,v <-- regress-449666.js
initial revision: 1.1
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•