Closed
Bug 833340
Opened 12 years ago
Closed 12 years ago
Fix a couple of jittests failing with rooting analysis
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla21
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(1 file)
(deleted),
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
Currently I see the following jittests failing with rooting analysis turned on:
/home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug599464.js
/home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug600128.js
/home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug607502.js
/home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug607513.js
/home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug638212.js
/home/jon/work/dev/tree/js/src/jit-test/tests/basic/bug698584.js
/home/jon/work/dev/tree/js/src/jit-test/tests/basic/testBug507425.js
/home/jon/work/dev/tree/js/src/jit-test/tests/basic/testOverRecursed4.js
/home/jon/work/dev/tree/js/src/jit-test/tests/ion/bug827821-2.js
Assignee | ||
Comment 1•12 years ago
|
||
Attachment #704884 -
Flags: review?(terrence)
Assignee | ||
Comment 2•12 years ago
|
||
Comment on attachment 704884 [details] [diff] [review]
Proposed fix
All jittests pass with the above patch.
The change to ConcatStringsMaybeAllowGC could perhaps be clearer, but I didn't immediately see a way to do this.
Comment 3•12 years ago
|
||
Comment on attachment 704884 [details] [diff] [review]
Proposed fix
Review of attachment 704884 [details] [diff] [review]:
-----------------------------------------------------------------
Excellent!
::: js/src/jsscope.cpp
@@ +1054,5 @@
> * initialized length and capacity of the object to zero and ensure that no
> * new dense elements can be added without calling growElements(), which
> * checks isExtensible().
> */
> + if (self->isNative() && !JSObject::sparsifyDenseElements(cx, self))
Ah, this is bug 830586. Please resolve it duplicate to this bug.
::: js/src/vm/String.cpp
@@ +314,5 @@
> return left;
>
> size_t wholeLength = leftLen + rightLen;
> + JSContext *cxIfCanGC = allowGC ? cx : NULL;
> + if (!JSString::validateLength(cxIfCanGC, wholeLength))
Thanks, that's way better. Please also change the name of validateLength's |cx| argument to |maybecx|.
Attachment #704884 -
Flags: review?(terrence) → review+
Assignee | ||
Comment 5•12 years ago
|
||
Comment 6•12 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in
before you can comment on or make changes to this bug.
Description
•