JM: jsreftest shell regressions from JM rev 35fed487745d

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: dmandelin, Assigned: dmandelin)

Tracking

Trunk
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

7 years ago
This rev caused 6 regressions on shell jsreftest only:

e4x\decompilation\regress-429249.js
ecma\extensions\trapflatclosure.js
js1_7\decompilation\regress-429252.js
js1_5\extensions\regress-431428.js
js1_5\extensions\regress-429264.js
js1_5\extensions\regress-422137.js
(Assignee)

Comment 1

7 years ago
Created attachment 469261 [details] [diff] [review]
Patch

The recompiler wants to call ReleaseScriptCode to invalidate a script. This used to set script->execPool to NULL, which told us that the script had no compiled code, so we don't need to free that stuff again. With the regressing changeset, script->jit now indicates jit-code is present, but it is not nulled by ReleaseScriptCode. So we go ahead and try to free its member fields, which are garbage.

The fix just nulls out script->jit again.
Assignee: general → dmandelin
Status: NEW → ASSIGNED
Attachment #469261 - Flags: review?(dvander)
Attachment #469261 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

7 years ago
http://hg.mozilla.org/projects/jaegermonkey/rev/e48d1b1638dd
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.