Closed
Bug 540136
Opened 15 years ago
Closed 15 years ago
TM: "Assertion failure: JSOP_NAME variable found in outer trace, at ../jstracer.cpp" with recursion
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Assigned: dmandelin)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file, 1 obsolete file)
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
(eval("\ function () {\ for (var[x] = function(){} in \ (function m(a) {\ if (a < 1) {\ x;\ return\ }\ return m(a - 1) + m(a - 2)\ })(7)\ (eval(\"\"))\ )\ ([])\ }\ "))() asserts js debug shell with -j on TM tip at Assertion failure: JSOP_NAME variable found in outer trace, at ../jstracer.cpp:3303, js opt shell does not seem to crash. autoBisect shows this is probably related to bug 495331: The first bad revision is: changeset: 37046:910ee7db07de user: David Mandelin date: Fri Jan 15 11:32:14 2010 -0800 summary: Bug 495331: trace JSOP_LAMBDA for non-heavyweight, non-null closures, r=jorendorff,dvander
Assignee | ||
Comment 1•15 years ago
|
||
Looks like a line of code that was supposed to be moved got copied instead. Probably a rebasing error or the like. Patch comes with a free comment update.
Assignee | ||
Comment 2•15 years ago
|
||
Attachment #422472 -
Attachment is obsolete: true
Attachment #422473 -
Flags: review?
Attachment #422472 -
Flags: review?(dvander)
Assignee | ||
Updated•15 years ago
|
Attachment #422473 -
Flags: review? → review?(dvander)
![]() |
||
Updated•15 years ago
|
Attachment #422473 -
Flags: review?(dvander) → review+
Assignee | ||
Comment 3•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/cb79eb2076f2
Whiteboard: fixed-in-tracemonkey
Comment 4•15 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/cb79eb2076f2
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Comment 5•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/closures/bug540136.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•