Closed Bug 464089 Opened 16 years ago Closed 16 years ago

TM: "Assertion failure: exit->numStackSlots == stableTree->stackTypeMap.length()" at Guy Kawasaki's blog

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: dvander)

References

()

Details

(Keywords: assertion)

Attachments

(1 file, 1 obsolete file)

Loading http://blog.guykawasaki.com/2005/12/the_102030_rule.html triggers this fatal assertion in my mozilla-central debug build:

Assertion failure: exit->numStackSlots == stableTree->stackTypeMap.length(), at /Users/jruderman/central/js/src/jstracer.cpp:2164
Assignee: general → danderson
Summary: "Assertion failure: exit->numStackSlots == stableTree->stackTypeMap.length()" at Guy Kawasaki's blog → TM: "Assertion failure: exit->numStackSlots == stableTree->stackTypeMap.length()" at Guy Kawasaki's blog
Attached patch proposed fix + test case (obsolete) — Splinter Review
closeLoop and endLoop now trash and blacklist the tree on mismatching stack depths, a case revealed by thin loops and minimal recursion
Attachment #347903 - Flags: review?(gal)
Andreas pointed out that this check isn't safe.  New patch uses callDepth.
Attachment #347903 - Attachment is obsolete: true
Attachment #347905 - Flags: review?(gal)
Attachment #347903 - Flags: review?(gal)
Attachment #347905 - Flags: review?(gal) → review+
Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/e66634bc7d23
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
test already in js1_8_1/trace/trace-test.js
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: