Closed
Bug 659337
Opened 10 years ago
Closed 10 years ago
TI: "Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM," with trap
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase)
f = Function("for (x = 0; x < 6; x++) { gc() }");
dis(f)
trap(f, 23, '');
f()
asserts js debug shell on JM changeset 29f08848d96c with -m, -a, -d and -n at Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM,
Woo-hoo! My 1,000th bug!
===
flags: LAMBDA
off op
----- --
main:
00000: bindname "x"
00003: zero
00004: setname "x"
00007: pop
00008: goto 27 (19)
00011: trace 0
00014: callname "gc"
00019: call 0
00022: pop
00023: nameinc "x" <-- trap goes here
00026: pop
00027: name "x"
00032: int8 6
00034: lt
00035: ifne 11 (-24)
00038: stop
Source notes:
ofs line pc delta desc args
---- ---- ----- ------ -------- ------
0: 1 7 [ 7] for cond 19 update 15 tail 27
4: 1 11 [ 4] while offset 24
6: 1 19 [ 8] xdelta
7: 1 19 [ 0] pcbase offset 5
|
||
Comment 1•10 years ago
|
||
Fix a few places we needed to untrap at when rejoining into the interpreter. http://hg.mozilla.org/projects/jaegermonkey/rev/0d3bcf8e0bb8
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•