Closed
Bug 621121
Opened 14 years ago
Closed 14 years ago
Assert isObject() with function increment
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 618007
| Tracking | Status | |
|---|---|---|
| blocking2.0 | --- | betaN+ |
People
(Reporter: decoder, Assigned: adrake)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: softblocker)
Attachments
(1 file, 1 obsolete file)
|
(deleted),
patch
|
Details | Diff | Splinter Review |
The following code asserts in shell on mozilla-central-trunk:
var foo;
testFoo(0);
testFoo(0);
function testFoo(i)
{
foo = getFoo(i);
}
function getFoo(i)
{
getFoo++;
}
Assertion failure: isObject(), at jsvalue.h:602
|
Assignee | |
Comment 1•14 years ago
|
||
Bisecting on tracemonkey yields:
changeset: 52243:db403b4edf3e
parent: 52220:9889018ba3cf
parent: 52242:68f7019ffed5
user: David Anderson <dvander@alliedmods.net>
date: Mon Jul 05 18:07:39 2010 -0700
summary: [JAEGER] Merge from fatval & TM.
changeset: 52244:0ea22d1ff97e
user: David Anderson <dvander@alliedmods.net>
date: Mon Jul 05 20:14:42 2010 -0700
summary: [JAEGER] Unbroke build, merge merge merge.
|
|
Assignee | |
Comment 2•14 years ago
|
||
After further digging behind that merge, the actual first bad revision is:
changeset: 51981:56ac5ae1825d
user: David Anderson <danderson@mozilla.com>
date: Thu Jun 10 23:43:14 2010 -0700
summary: [JAEGER] Statically bind some global functions (bug 562729, r=brendan).
|
||
Comment 3•14 years ago
|
||
To clarify: it asserts with 'js' and 'js -j'. It runs correctly with 'js -m' or any other invocation involving '-m'.
It's a regression. I bisected it to the JM merge :(
|
|
||
Comment 4•14 years ago
|
||
Looks like adrake beat me to it and did a better job!
|
|
Assignee | |
Comment 6•14 years ago
|
||
The problem is caused by INCGLOBAL/DECGLOBAL/GLOBALINC/GLOBALDEC not properly invalidating the shape if incrementing something other than an integer. I copied the logic to do this from SETGLOBAL/FORGLOBAL, and it appears to have fixed the regression.
Patch against tip forthcoming.
|
|
Assignee | |
Updated•14 years ago
|
Assignee: general → adrake
|
|
Assignee | |
Comment 7•14 years ago
|
||
Patch against tip. Doesn't regress any jstests and fixes given test case.
|
|
Assignee | |
Comment 8•14 years ago
|
||
With regression test for test suite.
Attachment #499622 -
Attachment is obsolete: true
|
|
Assignee | |
Comment 9•14 years ago
|
||
Bug 618007 removes the INCGLOBAL/DECGLOBAL/etc ops entirely, rendering this fix obsolete when that one lands.
|
||
Updated•14 years ago
|
blocking2.0: ? → betaN+
|
|
||
Updated•14 years ago
|
Whiteboard: softblocker
|
|
||
Updated•14 years ago
|
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•