js1_6/extensions/regress-456826.js - Assertion failure: !JS_TRACE_MONITOR(cx).needFlush

VERIFIED FIXED

Status

()

Core
JavaScript Engine
P1
normal
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: bc, Assigned: gal)

Tracking

(4 keywords)

Trunk
x86
All
assertion, regression, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
debug shell with -j:
js1_6/extensions/regress-456826.js
Assertion failure: !JS_TRACE_MONITOR(cx).needFlush, at ../jstracer.cpp:3886

crashes opt browser without -j:
Flags: in-testsuite+
Flags: blocking1.9.1?
(Assignee)

Comment 1

9 years ago
Created attachment 377038 [details] [diff] [review]
patch

If we manage to need a flush after an execute tree, do so instead of extending/stabilizing trees.
Assignee: general → gal
(Assignee)

Comment 2

9 years ago
This is a blocker, even without the dependency (the underlying bug exists on branch and trunk).
Priority: -- → P1
Attachment #377038 - Flags: review+
(Assignee)

Comment 3

9 years ago
http://hg.mozilla.org/tracemonkey/rev/c8a74fe0f9af
Whiteboard: fixed-in-tracemonkey
(Assignee)

Comment 4

9 years ago
Backed out.

http://hg.mozilla.org/tracemonkey/rev/9a308a1a5a94
Whiteboard: fixed-in-tracemonkey
(Assignee)

Comment 5

9 years ago
Landed again.

http://hg.mozilla.org/tracemonkey/rev/c18256887776
Whiteboard: fixed-in-tracemonkey

Comment 6

9 years ago
http://hg.mozilla.org/mozilla-central/rev/c18256887776
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Resolution: --- → FIXED
(Reporter)

Comment 9

9 years ago
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.