Closed Bug 522569 Opened 15 years ago Closed 15 years ago

TM: "Assertion failure: JS_MAX_INLINE_CALL_COUNT > inlineCallCount" with valueOf, too-much-recursion

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: dvander)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

function f(d) { if (d > 0) { new Number({}).valueOf("number"); f(d - 1); } } try { f(3000); } catch(e) { } Assertion failure: JS_MAX_INLINE_CALL_COUNT > inlineCallCount, at ../jstracer.cpp:6377
Attached patch fixSplinter Review
I just can't seem to get enough of these bogus assertions. The MAX_INLINE_CALL_COUNT check occurs before incrementing, so this check should be >=, I think.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #406550 - Flags: review?(brendan)
Comment on attachment 406550 [details] [diff] [review] fix I don't follow: if this assertion is pre-increment, then it botched when inlineCallCount == MAX, which means post-increment the value would be >. House style would use <=, btw. /be
(In reply to comment #2) > (From update of attachment 406550 [details] [diff] [review]) > I don't follow: if this assertion is pre-increment, then it botched when > inlineCallCount == MAX, which means post-increment the value would be >. assertion is actually post-increment, the js_ReportOverRecursed check is pre-increment. inline_call checks |inlineCallCount >= JS_MAX_INLINE_CALLCOUNT|, which is (2999 >= 3000). Then |inlineCallCount++| bumps it to 3000 The JIT might not actually add any frames, so the allowed frame depth being 0 is okay.
Comment on attachment 406550 [details] [diff] [review] fix Ok, but use <= and comment that this is post-inc. /be
Attachment #406550 - Flags: review?(brendan) → review+
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Bug in removed tracer code, setting in-testsuite- flag.
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: