If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

TM: Inner trees with a return don't terminate the loop (like break does).

RESOLVED FIXED in mozilla1.9.1b1

Status

()

Core
JavaScript Engine
P1
major
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: gal, Assigned: brendan)

Tracking

unspecified
mozilla1.9.1b1
Points:
---
Bug Flags:
in-testsuite -
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

Comment hidden (empty)
Created attachment 337256 [details]
This seems to be the testcase for this bug, I think.
(Assignee)

Comment 2

9 years ago
Created attachment 337397 [details] [diff] [review]
fix

This plus my other fixes gets v8/raytrace.js down to 10 aborts, all

Abort recording (line 3198, pc 136): Inner tree not suitable for calling.

/be
Assignee: general → brendan
Attachment #337397 - Flags: review?(gal)
(Assignee)

Updated

9 years ago
Severity: normal → major
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b1
(Reporter)

Comment 3

9 years ago
Comment on attachment 337397 [details] [diff] [review]
fix

Is there a way to check that the return is within the loop? Otherwise we might follow a loop over the not-taken loop edge (we happen to record the loop end case), and then suck in the return after the loop. Not sure this is a problem though. We will see.
(Reporter)

Updated

9 years ago
Attachment #337397 - Flags: review?(gal) → review+
(Assignee)

Comment 4

9 years ago
Fixed on tracemonkey:

http://hg.mozilla.org/tracemonkey/rev/dcb86d40fc58

/be
(Assignee)

Comment 5

9 years ago
Fixed on m-c:

http://hg.mozilla.org/mozilla-central/rev/dcb86d40fc58

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Updated

9 years ago
Flags: in-testsuite-
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.