Closed Bug 662562 Opened 9 years ago Closed 9 years ago

TI: crash [@js::analyze::UntrapOpcode::UntrapOpcode]

Categories

(Core :: JavaScript Engine, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

--
function f(o) {
    o.watch("x", this);
}
var c = evalcx("");
f(c);
--
Crashes 32-bit shell with -n, revision 877522d92ad4.
I have identical crashes on debug/opt Linux/Mac 32/64-bit shells as well.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   70389:51de14efb83c
user:        Brian Hackett
date:        Sun Jun 05 22:39:45 2011 -0700
summary:     [INFER] Apply stack review comments, bug 657412.
Blocks: 657412
Severity: normal → critical
Version: unspecified → Trunk
The new cx->stack.currentScript() function did not compute the topmost script's pc correctly when cx->fp() is a dummy frame.

http://hg.mozilla.org/projects/jaegermonkey/rev/afe33041f481
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Depends on: 662841
Keywords: crash
You need to log in before you can comment on or make changes to this bug.