520210 - js_PopInterpFrame breaks arena LIFO invariant

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 1

[Brendan Eich [:brendan]]

See my review comments at bug 459301 comment 44.

/be

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: v2

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 404301 [details] [diff] [review]
v2

>+++ b/js/src/jstracer.h
>@@ -731,7 +731,7 @@ struct InterpState
>     double*        deepBailSp;
> 
> 
>-    // Used when calling natives from trace to root the vp vector. */
>+    // Used when calling natives from trace to root the vp vector.
>     uintN          nativeVpLen;
>     jsval         *nativeVp;
> };

This will conflict with Andreas, but it's a good fix. Bonus point for removing one of the two blank lines before the comment.

/be

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/8954a8abbeb4

Forgot to remove extra blank line before qfin - no bonus points.

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/8954a8abbeb4