Closed
Bug 674364
Opened 14 years ago
Closed 14 years ago
TI: Assertion failure: obj->isObject(), at jsinterp.cpp:5273
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
7.75 KB,
application/x-compressed-tar
|
Details |
The attached testcase asserts on TI revision bd40ad1be9d8. To run this test, see the README file in the archive (the test is fragile and cannot be detached from the driver easily as it seems).
|
||
Comment 1•14 years ago
|
||
The wrong PC was being used when calling one of several lambda-related stubs that avoid cloning the function in certain circumstances (the stub expects the wrong PC, and uses it to see whether to avoid the clone). This led to an incorrect interpreter state after rejoining if the stubs triggered a recompilation (only possible now that GCs discard all jitcode on the stack). The fix uses the correct PC for the call and stores the other PC in f.scratch for use by the stub.
http://hg.mozilla.org/projects/jaegermonkey/rev/d43c6dddeb2b
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•