454353 - TM: abort on string-tagcloud.js:241 due to hoisted-var spurious type mismatch

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, enhancement, P3)

Description

[Robert Sayre]

./Darwin_DBG.OBJ/js -j -f t/string-tagcloud.js | grep -B 3 -A 3 "p->scopeChain is not global or active call object"
    eq15 = eq eq14, 0
    xf15: xf eq14 -> 0x303726 sp+16 rp+0

abort: 2803: fp->scopeChain is not global or active call object
Abort recording (line 185, pc 65): JSOP_CALLNAME.
recording starting from t/string-tagcloud.js:183@30
    trace

Comment 1

[Brendan Eich [:brendan]]

Dup of bug 454042 but I'm dup'ing forward since this bug has the pithy testcase.

/be

Comment 3

[Brendan Eich [:brendan]]

Symptom is gone, but t/string-tagcloud.js aborts because of hoisted-var undefined vs. string type mismatch. Morphing bug, handing to David who is working on a new solution for that problem.

entering trace at t/string-tagcloud.js:242@56, native stack slots: 16 code: 0x2fda9b
global: object<0x255150:Function> 
stack: callee0=object<0x25ca48:Function> this0=object<0x256000:global> argv0=object<0x256380:Array> vars0=string<0x5080c8> vars1=int<1> vars2=string<0x2ef998> vars3=boolean<1> vars4=int<0> vars5=int<97> vars6=bool != tag4 type-map mismatch.

Breakpoint 1, js_RecordLoopEdge (cx=0x300cf0, r=0x60bec0, oldpc=0x814703 "\b??V", inlineCallCount=@0xbfffd990) at jstracer.cpp:2405
2405	                js_AbortRecording(cx, oldpc, "Couldn't call inner tree");
(gdb) n
Abort recording (line 241, pc 111): Couldn't call inner tree.

/be

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Obsolete with the removal of tracejit.