Closed
Bug 655938
Opened 14 years ago
Closed 14 years ago
TI: Crash [@ js::types::TypeFailure] involving missing type object jitstats:prototype:new HOTLOOP: int
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
tracemonkey.HOTLOOP
crashes js debug shell on JM changeset 32e8c937a409 with -m, -a, -j and -n at js::types::TypeFailure with the following message:
[infer failure] Missing type in object jitstats:prototype:new HOTLOOP: int
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 68842:c963b24694cd
user: Brian Hackett
date: Mon May 09 07:12:47 2011 -0700
summary: [INFER] Remove on stack recompilation, allow removed on stack JIT frames to rejoin into the interpreter, bug 650163.
|
||
Comment 1•14 years ago
|
||
We needed a type barrier for getProperty accesses which go through the class getProperty hook.
http://hg.mozilla.org/projects/jaegermonkey/rev/2b272d7fb2e5
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Updated•14 years ago
|
Crash Signature: [@ js::types::TypeFailure]
You need to log in
before you can comment on or make changes to this bug.
Description
•