Closed
Bug 586866
Opened 15 years ago
Closed 15 years ago
`in` in loop condition quirks with JIT
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
| Tracking | Status | |
|---|---|---|
| blocking2.0 | --- | betaN+ |
People
(Reporter: murky.satyr, Assigned: luke)
References
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files)
|
301 bytes,
text/html
|
Details | |
|
1.42 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
With JIT enabled, the attachment fails intermittently on Fx0.4b4pre and consistently on Fx3.6.8.
|
||
Updated•15 years ago
|
blocking2.0: --- → ?
|
||
Updated•15 years ago
|
blocking2.0: ? → betaN+
OS: Windows Vista → Windows 2000
|
|
Assignee | |
Comment 1•15 years ago
|
||
I am able to reproduce the failure on 4.0b6 on practically every other reload, but, after 100 reloads, I cannot reproduce on TM tip.
|
|
||
Comment 2•15 years ago
|
||
On TM tip, I would expect we don't trace this particular testcase. Even if you disable JM, because we bumped HOTLOOP....
|
|
Assignee | |
Comment 3•15 years ago
|
||
Good point. If I add more calls to func() and turn off the mjit/profiling, then it reproduces.
Assignee: general → lw
|
|
Assignee | |
Comment 4•15 years ago
|
||
The problem is that JSOP_IN is calling fuseIf but not calling checkTraceEnd. This causes the recorder to keep recording off the end of the loop, which produces a loop which runs once and returns.
Thanks for the reduced test case satyr!
Attachment #489074 -
Flags: review?(dvander)
|
|
||
Updated•15 years ago
|
Attachment #489074 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 5•15 years ago
|
||
Whiteboard: fixed-in-tracemonkey
|
|
||
Comment 7•15 years ago
|
||
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•