Closed Bug 659337 Opened 9 years ago Closed 9 years ago

TI: "Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM," with trap

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

f = Function("for (x = 0; x < 6; x++) { gc() }");
dis(f)
trap(f, 23, '');
f()

asserts js debug shell on JM changeset 29f08848d96c with -m, -a, -d and -n at Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM,

Woo-hoo! My 1,000th bug!

===

flags: LAMBDA
off     op
-----   --
main:
00000:  bindname "x"
00003:  zero
00004:  setname "x"
00007:  pop
00008:  goto 27 (19)
00011:  trace 0
00014:  callname "gc"
00019:  call 0
00022:  pop
00023:  nameinc "x"        <-- trap goes here
00026:  pop
00027:  name "x"
00032:  int8 6
00034:  lt
00035:  ifne 11 (-24)
00038:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     7 [   7] for      cond 19 update 15 tail 27
  4:    1    11 [   4] while    offset 24
  6:    1    19 [   8] xdelta  
  7:    1    19 [   0] pcbase   offset 5
Fix a few places we needed to untrap at when rejoining into the interpreter.

http://hg.mozilla.org/projects/jaegermonkey/rev/0d3bcf8e0bb8
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.