Closed Bug 450304 Opened 11 years ago Closed 11 years ago

TM: asserts logging into gmail

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: dvander, Assigned: dvander)

References

()

Details

Attachments

(1 file, 1 obsolete file)

Attached file trace and gdb dump (obsolete) —
assertion is in nanojit, somewhere we're generating an feq(i2f, imm(1)) which is invalid
Blocks: landtm
Committed fix, please re-test and close if fixed.

http://hg.mozilla.org/index.cgi/tracemonkey/rev/cdda9caf1fb2
Assignee: general → danderson
Whats the status of this bug?
Attached file trace and gdb dump
Current tip hard crashes when logging into gmail.  Keeping the debugging session open on my laptop in MV.
Attachment #333456 - Attachment is obsolete: true
Fixed, at least any for-in badness, by:

http://hg.mozilla.org/tracemonkey/index.cgi/rev/b7199324e019

David, can you mark this bug FIXED if gmail works for sure with TM tip?

/be
(Logging into gmail worked because after rm -rf .mozilla the JIT was defaulting to off)
The n < cx->fp->script->nfixed assert in TraceRecorder::varval is wrong. The code is using let in a for each in loop that was recorded, but the enclosing JSOP_ENTERBLOCK was not seen.

Fixing the assert to use cx->fp->script->nslots instead is easy, but then we get another crash, this time due to test_property_cache being buggy. I'm going to fix that and use this bug to see what's next ;-).

/be
Awesome, gmail seems to work with tip now.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Flags: in-testsuite-
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.