Closed Bug 492664 Opened 15 years ago Closed 15 years ago

js1_6/extensions/regress-456826.js - Assertion failure: !JS_TRACE_MONITOR(cx).needFlush

Categories

(Core :: JavaScript Engine, defect, P1)

x86
All
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: bc, Assigned: gal)

References

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

debug shell with -j:
js1_6/extensions/regress-456826.js
Assertion failure: !JS_TRACE_MONITOR(cx).needFlush, at ../jstracer.cpp:3886

crashes opt browser without -j:
Flags: in-testsuite+
Flags: blocking1.9.1?
Attached patch patchSplinter Review
If we manage to need a flush after an execute tree, do so instead of extending/stabilizing trees.
Assignee: general → gal
This is a blocker, even without the dependency (the underlying bug exists on branch and trunk).
Priority: -- → P1
Attachment #377038 - Flags: review+
http://hg.mozilla.org/tracemonkey/rev/c8a74fe0f9af
Whiteboard: fixed-in-tracemonkey
Backed out.

http://hg.mozilla.org/tracemonkey/rev/9a308a1a5a94
Whiteboard: fixed-in-tracemonkey
Landed again.

http://hg.mozilla.org/tracemonkey/rev/c18256887776
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/c18256887776
Status: NEW → RESOLVED
Closed: 15 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Resolution: --- → FIXED
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: