454027 - TM: Inner trees with a return don't terminate the loop (like break does).

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: This seems to be the testcase for this bug, I think.

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

This plus my other fixes gets v8/raytrace.js down to 10 aborts, all

Abort recording (line 3198, pc 136): Inner tree not suitable for calling.

/be

Comment 3

[Andreas Gal :gal]

Comment on attachment 337397 [details] [diff] [review]
fix

Is there a way to check that the return is within the loop? Otherwise we might follow a loop over the not-taken loop edge (we happen to record the loop end case), and then suck in the return after the loop. Not sure this is a problem though. We will see.

Comment 4

[Brendan Eich [:brendan]]

Fixed on tracemonkey:

http://hg.mozilla.org/tracemonkey/rev/dcb86d40fc58

/be

Comment 5

[Brendan Eich [:brendan]]

Fixed on m-c:

http://hg.mozilla.org/mozilla-central/rev/dcb86d40fc58

/be