Closed
Bug 768004
Opened 12 years ago
Closed 12 years ago
IonMonkey: Don't monitor the stack value for non-ResumeAfter bailouts
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file)
|
1.17 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
decoder reported a testcase on IRC where the overrecursion check triggered a GC + invalidaton. The first opcode in the script was JSOP_GETGNAME so InvalidationBailout tried to monitor the value on top of the stack and we'd crash.
The fix is to only monitor the value for resumeAfter bailouts - in all other cases the value on the stack is invalid and we will just redo the op in the interpreter.
Attachment #636317 -
Flags: review?(dvander)
|
||
Updated•12 years ago
|
Attachment #636317 -
Flags: review?(dvander) → review+
|
Assignee | |
Comment 1•12 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•