Closed Bug 463956 Opened 11 years ago Closed 11 years ago

TM: JIT: ecma/GlobalObject/ FAIL


(Core :: JavaScript Engine, defect)

Not set





(Reporter: bc, Unassigned)




(4 keywords)

browser, jit on only. I could reproduce with nightly and debug builds on mac, but only nightly builds on 64bit linux for some reason. 

ecma/GlobalObject/ FAIL

escape(String.fromCharCode(n)) reason: wrong value for n >= 132
escape(String.fromCharCode(132)) = %84  FAILED! %04

failure pattern is the actual value is the last digit of the expected value.

bisection says regressed by bug 462184 but that doesn't really make sense to me.
Flags: in-testsuite+
Flags: in-litmus-
Flags: blocking1.9.1?
ecma/GlobalObject/ appears to be the same issue (although I'm confirming the regression range atm). 

unescape( %11 ) =    PASSED!
unescape( %02 ) =   FAILED! 
64-bit doesn't use jit atm afaik. David?
I forgot about the 64 bit stuff. The reason it failed on nightlies on 64bit linux is that the nightlies are 32bit. :-) The reason it didn't fail on debug builds on 64 bit linux is as Gal said.

BTW, add ecma/String/ to the list of regressions which all point to bug 462184.
Also js1_6/extensions/regress-455464-03.js browser only crashes with the same blame.


Reason: KERN_INVALID_ADDRESS at address: 0x304bf354
0x128e2fd8 in ?? ()
(gdb) bt
#0  0x128e2fd8 in ?? ()
#1  0x00c922c4 in ?? ()
Previous frame inner to this frame (gdb could not unwind past this frame)
note this occurs on mozilla-central as well after the merges.
Target Milestone: --- → mozilla1.9.1b2
Keywords: crash
Scary. We have to diagnose this today.
this appears to be fixed. I'm trying to find the benefactor via bisection at the moment.
ecma/GlobalObject/ still fails on both m-c/tm afaict.

the other tests pass with bisection pointing to which is the last changeset of a merge from m-c. I'll try to find the changset on m-c.
ecma/GlobalObject/, ecma/GlobalObject/ now pass on tracemonkey but not mozilla-central.
(In reply to comment #9)
> ecma/GlobalObject/, ecma/GlobalObject/ now pass on
> tracemonkey but not mozilla-central.

these were fixed by changeset: 21749:b8f6e95832c6 user: Andreas Gal <> date: Mon Nov 17 11:47:54 2008 -0800 summary: Don't attempt to immediately re-record after walking out of a thin loop (465366, r=danderson).
*** revision b8f6e95832c6 found ***
Fixed in the merge pushed by vlad on Nov 18 14:11:14 2008 -0800:
Closed: 11 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Resolution: --- → FIXED
v 1.9.1, 1.9.2
You need to log in before you can comment on or make changes to this bug.