Closed Bug 504078 Opened 11 years ago Closed 11 years ago
I was able to reproduce this on Windows Vista. Regression range: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a45593185b3a&tochange=ca4d8bb54e7f
Assignee: nobody → general
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Linux → All
Product: Firefox → Core
QA Contact: general → general
Hardware: x86 → All
Version: 3.5 Branch → Trunk
The reporter reported this on branch, and all the JS check ins in the range are also checked in on branch.
blocking1.9.1: --- → ?
Rob, Andreas, Brendan: can you take a look and renominate if you think we need to fix this in a dot-release?
blocking1.9.1: ? → -
Priority: -- → P1
waldo, could you take a look at this?
This is marked as blocking Firefox 3.6a1, any ETA? Should it not block that milestone?
Haven't looked at this yet, guessing it will be pretty simple to diagnose and fix -- maybe end of next week, what with everything on my plate currently? This is kind of a wild guess, to be honest, having not spent time investigating yet.
Thanks for the ETA; Sayrer, does this really need to block the alpha/branch? Needed for mobile?
regression changeset: 29380:1c0654b97fe1 user: Graydon Hoare <firstname.lastname@example.org> date: Thu Jun 18 14:47:57 2009 -0700 summary: Bug 497060 - Disable JIT on non-global initial scope chain, r=brendan.
Downgrading for the moment, this is in 3.5 already and not something that necessarily has to block 3.6a1 -- should be safe to punt further, fix seems unlikely to be complex and dangerous enough to warrant fixing *right now* and no later...
Priority: P1 → P2
http://hg.mozilla.org/tracemonkey/rev/4b9e2f886b9f /cvsroot/mozilla/js/tests/js1_5/Regress/regress-504078.js,v <-- regress-504078.js initial revision: 1.1
Hum, so we somehow exit back to the interpreter with an Iterator object on which we're going to try and call next(), but the Iterator has no "next" property, nothing on its prototype chain does, of course, and that gets us back undefined which can't be called as a function. Weird.
We shouldn't be in the custom_iter_next imacro here, we should be in the native_iter_next imacro. Something's making unwarranted assumptions here about iterator type or somesuch; more after lunch.
(We do record through nextiter for the first object as a native case, then through nextiter for window as a custom case [presumably due to a branch exit from the first trace], then through nextiter for the third object as a native case, tho.)
Comment on attachment 410703 [details] [diff] [review] The old new mistake D'oh -- my bad, sorry. /be
Attachment #410703 - Flags: review?(jorendorff) → review+
js1_5/Regress/regress-504078.js appears to randomly pass on mc/windows.
Whiteboard: fixed-in-tracemonkey → [orange][fixed-in-tracemonkey]
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Whiteboard: [orange][fixed-in-tracemonkey] → [fixed-in-tracemonkey]
You need to log in before you can comment on or make changes to this bug.