Closed
Bug 578897
Opened 14 years ago
Closed 14 years ago
JM: InstanceOf failing to PIC trips assert
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Assigned: dmandelin)
References
Details
Attachments
(2 files, 2 obsolete files)
|
(deleted),
text/plain
|
Details | |
|
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The patch from bug 578896 enables compiling with --disable-polyic.
With PICs disabled, basic/testNegativeArrayLength.js trips an assert within stubs::GetProp(), which trips itself looking through the property cache. Note that this can still occur if PICs are enabled, if the PIC fails.
In the attached backtrace, op == JSOP_INSTANCEOF, and js_CodeSpec[op].length == 1.
|
Reporter | |
Comment 1•14 years ago
|
||
Rebased previous patch onto moo tip. With patch applied and PICs disabled, there are 37 trace-test failures. These failures can be deterministically reproduced without disabling PICs, but this patch should ease debugging.
Attachment #457489 -
Attachment is obsolete: true
Attachment #457493 -
Flags: review?(dvander)
|
|
Reporter | |
Comment 2•14 years ago
|
||
Erm. Wrong bug for previous comment! Reverting, reverting.
Attachment #457493 -
Attachment is obsolete: true
Attachment #457493 -
Flags: review?(dvander)
|
||
Updated•14 years ago
|
Attachment #457499 -
Attachment is patch: false
|
Assignee | |
Updated•14 years ago
|
Assignee: general → dmandelin
|
|
Assignee | |
Comment 3•14 years ago
|
||
This seems to be the smallest edit distance fix.
|
|
Assignee | |
Updated•14 years ago
|
Attachment #458466 -
Flags: review?(dvander)
|
|
||
Updated•14 years ago
|
Attachment #458466 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 4•14 years ago
|
||
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•