Closed
Bug 611724
Opened 12 years ago
Closed 12 years ago
Assertion failure in TraceRecorder::emitIf()
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
Tracking | Status | |
---|---|---|
blocking2.0 | --- | betaN+ |
People
(Reporter: soubok, Assigned: n.nethercote)
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(4 files, 1 obsolete file)
Assertion failure: isCond(x), at .../js/src/jstracer.cpp:5327 => JS_ASSERT(isCond(x)) in TraceRecorder::emitIf() version: latest tracemonkey tip
js source code: function test() {} var b = Blob('1'); for (var i = 0; i < 71; i++ ) // I mean exactly 71 times or more for each ( var it in b ) test(); Blob is a JSClass that defines ext.iteratorObject (trying to create a complete testcase...)
![]() |
||
Updated•12 years ago
|
blocking2.0: --- → ?
Attachment #490148 -
Attachment is obsolete: true
![]() |
Assignee | |
Comment 5•12 years ago
|
||
Franck, I am unable to compile your test case. Can you give instructions for how to compile it? A JavaScript test would be much easier to deal with, if you can concoct one. Nonetheless, from the stack trace I think I see what the problem is. Attached patch is a possible fix. Franck, can you test it?
Attachment #490508 -
Flags: review?(gal)
The patch fix the assert failure. Note that I use msvc to compile my testcase and the assert failure only happens in debug build.
However I still have some strange behavior with my custom iterator object when JSOPTION_JIT is enabled. It is like if my JS_ThrowStopIteration has no more effect in an array comprehension statement. I am trying to create another testcase for this behavior without success...
With your patch applied, this new testcase hangs on when run in debug mode in msvc9.
![]() |
Assignee | |
Updated•12 years ago
|
Attachment #490508 -
Flags: review?(gal) → review?(dvander)
![]() |
Assignee | |
Comment 9•12 years ago
|
||
(In reply to comment #7) > However I still have some strange behavior with my custom iterator object when > JSOPTION_JIT is enabled. That's a different issue. Can you please file a new bug report? It makes tracking things easier if there's only one issue per bug report. Thanks.
![]() |
Assignee | |
Updated•12 years ago
|
Assignee: general → nnethercote
![]() |
||
Updated•12 years ago
|
Attachment #490508 -
Flags: review?(dvander) → review+
Reporter | ||
Comment 10•12 years ago
|
||
Bug 612523 has been created.
![]() |
Assignee | |
Comment 11•12 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/3c580750fa38
Whiteboard: fixed-in-tracemonkey
Comment 12•12 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/3c580750fa38
blocking2.0: ? → betaN+
![]() |
Assignee | |
Updated•12 years ago
|
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•