Closed
Bug 522569
Opened 15 years ago
Closed 15 years ago
TM: "Assertion failure: JS_MAX_INLINE_CALL_COUNT > inlineCallCount" with valueOf, too-much-recursion
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: dvander)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
944 bytes,
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
function f(d) { if (d > 0) { new Number({}).valueOf("number"); f(d - 1); } }
try { f(3000); } catch(e) { }
Assertion failure: JS_MAX_INLINE_CALL_COUNT > inlineCallCount, at ../jstracer.cpp:6377
![]() |
||
Updated•15 years ago
|
Keywords: regression
![]() |
Assignee | |
Comment 1•15 years ago
|
||
I just can't seem to get enough of these bogus assertions. The MAX_INLINE_CALL_COUNT check occurs before incrementing, so this check should be >=, I think.
Comment 2•15 years ago
|
||
Comment on attachment 406550 [details] [diff] [review]
fix
I don't follow: if this assertion is pre-increment, then it botched when inlineCallCount == MAX, which means post-increment the value would be >.
House style would use <=, btw.
/be
![]() |
Assignee | |
Comment 3•15 years ago
|
||
(In reply to comment #2)
> (From update of attachment 406550 [details] [diff] [review])
> I don't follow: if this assertion is pre-increment, then it botched when
> inlineCallCount == MAX, which means post-increment the value would be >.
assertion is actually post-increment, the js_ReportOverRecursed check is pre-increment. inline_call checks |inlineCallCount >= JS_MAX_INLINE_CALLCOUNT|, which is (2999 >= 3000). Then |inlineCallCount++| bumps it to 3000
The JIT might not actually add any frames, so the allowed frame depth being 0 is okay.
Comment 4•15 years ago
|
||
Comment on attachment 406550 [details] [diff] [review]
fix
Ok, but use <= and comment that this is post-inc.
/be
Attachment #406550 -
Flags: review?(brendan) → review+
![]() |
Assignee | |
Comment 5•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/1903f6af9cd8
pushed with nits
Whiteboard: fixed-in-tracemonkey
Comment 6•15 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Comment 7•12 years ago
|
||
Bug in removed tracer code, setting in-testsuite- flag.
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•