Closed Bug 463956 Opened 11 years ago Closed 11 years ago

TM: JIT: ecma/GlobalObject/15.1.2.4.js FAIL

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

VERIFIED FIXED
mozilla1.9.1b2

People

(Reporter: bc, Unassigned)

References

()

Details

(4 keywords)

browser, jit on only. I could reproduce with nightly and debug builds on mac, but only nightly builds on 64bit linux for some reason. 

ecma/GlobalObject/15.1.2.4.js FAIL

escape(String.fromCharCode(n)) reason: wrong value for n >= 132
escape(String.fromCharCode(132)) = %84  FAILED! %04

failure pattern is the actual value is the last digit of the expected value.

bisection says regressed by http://hg.mozilla.org/tracemonkey/rev/9994733fb845 bug 462184 but that doesn't really make sense to me.
Flags: in-testsuite+
Flags: in-litmus-
Flags: blocking1.9.1?
ecma/GlobalObject/15.1.2.5-1.js appears to be the same issue (although I'm confirming the regression range atm). 

unescape( %11 ) =    PASSED!
unescape( %02 ) =   FAILED! 
...
64-bit doesn't use jit atm afaik. David?
I forgot about the 64 bit stuff. The reason it failed on nightlies on 64bit linux is that the nightlies are 32bit. :-) The reason it didn't fail on debug builds on 64 bit linux is as Gal said.

BTW, add ecma/String/15.5.4.7-2.js to the list of regressions which all point to bug 462184.
Also js1_6/extensions/regress-455464-03.js browser only crashes with the same blame.

<http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=js1_6/extensions/regress-455464-04.js;language=type;text/javascript">

Reason: KERN_INVALID_ADDRESS at address: 0x304bf354
0x128e2fd8 in ?? ()
(gdb) bt
#0  0x128e2fd8 in ?? ()
#1  0x00c922c4 in ?? ()
Previous frame inner to this frame (gdb could not unwind past this frame)
note this occurs on mozilla-central as well after the merges.
Target Milestone: --- → mozilla1.9.1b2
Keywords: crash
Scary. We have to diagnose this today.
this appears to be fixed. I'm trying to find the benefactor via bisection at the moment.
ecma/GlobalObject/15.1.2.4.js still fails on both m-c/tm afaict.

the other tests pass with bisection pointing to  http://hg.mozilla.org/tracemonkey/rev/e94041498958 which is the last changeset of a merge from m-c. I'll try to find the changset on m-c.
ecma/GlobalObject/15.1.2.5-1.js, ecma/GlobalObject/15.1.2.4.js now pass on tracemonkey but not mozilla-central.
(In reply to comment #9)
> ecma/GlobalObject/15.1.2.5-1.js, ecma/GlobalObject/15.1.2.4.js now pass on
> tracemonkey but not mozilla-central.

these were fixed by changeset: 21749:b8f6e95832c6 user: Andreas Gal <gal@mozilla.com> date: Mon Nov 17 11:47:54 2008 -0800 summary: Don't attempt to immediately re-record after walking out of a thin loop (465366, r=danderson).
*** revision b8f6e95832c6 found ***
Fixed in the merge pushed by vlad on Nov 18 14:11:14 2008 -0800: http://hg.mozilla.org/mozilla-central/rev/e8ed5d4bf531
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Resolution: --- → FIXED
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.