Closed
Bug 659337
Opened 10 years ago
Closed 10 years ago
TI: "Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM," with trap
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase)
f = Function("for (x = 0; x < 6; x++) { gc() }"); dis(f) trap(f, 23, ''); f() asserts js debug shell on JM changeset 29f08848d96c with -m, -a, -d and -n at Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM, Woo-hoo! My 1,000th bug! === flags: LAMBDA off op ----- -- main: 00000: bindname "x" 00003: zero 00004: setname "x" 00007: pop 00008: goto 27 (19) 00011: trace 0 00014: callname "gc" 00019: call 0 00022: pop 00023: nameinc "x" <-- trap goes here 00026: pop 00027: name "x" 00032: int8 6 00034: lt 00035: ifne 11 (-24) 00038: stop Source notes: ofs line pc delta desc args ---- ---- ----- ------ -------- ------ 0: 1 7 [ 7] for cond 19 update 15 tail 27 4: 1 11 [ 4] while offset 24 6: 1 19 [ 8] xdelta 7: 1 19 [ 0] pcbase offset 5
Comment 1•10 years ago
|
||
Fix a few places we needed to untrap at when rejoining into the interpreter. http://hg.mozilla.org/projects/jaegermonkey/rev/0d3bcf8e0bb8
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•