Closed
Bug 707384
Opened 13 years ago
Closed 13 years ago
TI: "Assertion failure: getCode(offset).loop," with trap
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla11
People
(Reporter: gkw, Assigned: bhackett1024)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: js-triage-needed)
Attachments
(2 files)
5.41 KB,
text/plain
|
Details | |
2.16 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
function f() { do { return } while (e) } dis(f) trap(f, 1, '') f() asserts js debug shell on m-c changeset 6180c68bffbf with -m, -a, -n and -d at Assertion failure: getCode(offset).loop,
Reporter | ||
Comment 1•13 years ago
|
||
autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 81128:d32ccb2b8a05 user: Brian Hackett date: Thu Dec 01 15:13:51 2011 -0800 summary: Remove JSOP_NOTRACE, rename JSOP_TRACE -> JSOP_LOOPHEAD, bug 706611. r=dvander
Blocks: 706611
Reporter | ||
Updated•13 years ago
|
Keywords: regression
Assignee | ||
Comment 2•13 years ago
|
||
One of the test changes in bug 706611 was incorrect, the compiler needs to check that a loop head has a reachable backedge before compiling it as a loop.
Assignee: general → bhackett1024
Attachment #579856 -
Flags: review?(dvander)
Updated•13 years ago
|
Attachment #579856 -
Flags: review?(dvander) → review+
Assignee | ||
Comment 3•13 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/7769ec8647b9
Comment 4•13 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/7769ec8647b9
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla11
Comment 5•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug707384.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•