450320 |
Remove 'op' local variable from js_Interpret |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
609296 |
Number.toString() is slow |
|
FIXED |
Jan de Mooij [:jandem] |
634417 |
Remove uses of vanilla malloc/calloc/realloc/free |
[qa-] |
FIXED |
Nicholas Nethercote [inactive] |
653438 |
Incorrect result with number.toExponential(undefined) |
|
FIXED |
Jan de Mooij [:jandem] |
654820 |
Assertion failure: m_pools.empty(), at js/src/assembler/jit/ExecutableAllocator.h:180 |
[MemShrink:P3] |
FIXED |
Dan Gohman [:sunfish] |
658800 |
Properties on an Error become enumerable after toSource is called? |
[qa-] |
FIXED |
Jeff Walden [:Waldo] |
724768 |
Object.getOwnPropertyNames does not see unresolved properties of Error objects |
[qa-][DocArea=JS] |
FIXED |
Jeff Walden [:Waldo] |
753203 |
[meta] GC: Exact Stack Rooting |
|
FIXED |
Terrence Cole [:terrence] |
760460 |
Assertion failure: i < argc_, at ../dist/include/js/CallArgs.h:283 or Crash [@ ToPrimitive] with line2pc |
[js:p3] [jsbugmon:testComment=4] |
FIXED |
Tom S [:evilpie] |
784295 |
Investigate activating ES5 strict mode for all self-hosted JS |
[js:t][qa-] |
FIXED |
Chris Peterson [:cpeterson] |
806522 |
"Assertion failure: getSlot(EVAL).isObject()," or Assertion failure: getSlotRefForCompilation(EVAL).isObject(), at js/src/vm/GlobalObject.h |
[jsbugmon:update] |
FIXED |
Jason Orendorff [:jorendorff] |
811264 |
Signed integer overflows in js::Int32ToString and IntToCString |
[js:t] [-fsanitize=signed-integer-overflow][qa-] |
FIXED |
Jeff Walden [:Waldo] |
822425 |
Expose assertSameCompartment outside the JS engine |
[qa-] |
FIXED |
Bobby Holley (:bholley) |
837566 |
Remove js_RemoveRoot. |
[qa-] |
FIXED |
Nicholas Nethercote [inactive] |
852175 |
Assertion failure: cur_ == frame_.fun()->environment(), at vm/ScopeObject.cpp:1046 |
[jsbugmon:update,testComment=8,origRev=59ff3a2a708a] |
FIXED |
Kannan Vijayan [:djvj] |
852791 |
IonMonkey: Improve constant propagation on string concatenation. |
[lang=c++][qa-] |
FIXED |
Masaya Iseki[:isk](UTC+9) |
861785 |
Odinmonkey (ARM): use the hard-float ABI for inter-asm.js calls, even when the system is using the soft-float ABI. |
|
FIXED |
Douglas Crosher [:dougc] |
869473 |
Optimize DivI with a power of two divisor when the numerator is positive. |
|
FIXED |
Douglas Crosher [:dougc] |
880512 |
ARM: Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp with "use asm" |
|
FIXED |
Dan Gohman [:sunfish] |
884617 |
Explicitly --disable-threadsafe for the SM(r) build on TBPL |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
884676 |
Use mozilla::Atomic instead of JS_ATOMIC_* |
[qa-] |
FIXED |
Joshua Cranmer [:jcranmer] |
887077 |
JS::CompileOptions incorrectly roots 'element' member |
|
FIXED |
Jim Blandy :jimb |
892643 |
SpiderMonkey needs a root type with unrestricted lifetime that can be copied and assigned |
|
FIXED |
Jim Blandy :jimb |
894658 |
Implement ES6 Array.prototype.{keys, entries} |
[DocArea=JS] |
FIXED |
Sankha Narayan Guria [:sankha] |
894881 |
Accessing typed array properties like byteLength is very slow |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
895395 |
Support NameFunctions when compiling scripts off the main thread |
[qa-] |
FIXED |
Bill McCloskey [inactive unless it's an emergency] (:billm) |
897027 |
Missing ToNumber conversion for Math.pow()/Math.atan() when passing only one argument |
|
FIXED |
David Caabeiro [:dcaabeiro] |
898359 |
[binary data] non-scalar types like any, object, and string |
|
FIXED |
Niko Matsakis [:nmatsakis] |
900998 |
Static analysis is missing WorkerPrivate::Create |
[qa-] |
FIXED |
general |
901274 |
Reduce branching in testObjectTruthy and testValueTruthy |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
903332 |
document.watch() results in "TypeError: can't watch non-native objects of class Proxy" |
|
FIXED |
Jeff Walden [:Waldo] |
906858 |
Assertion failure: v->toGCThing(), at gc/Marking.cpp with --ion-eager --ion-gvn=pessimistic --ion-inlining=off --ion-regalloc=backtracking |
|
FIXED |
Dan Gohman [:sunfish] |
909490 |
Add ability to get and set per-Zone user data, and iterate over Zones |
[qa-] |
FIXED |
Andrew McCreight [:mccr8] |
909526 |
Suppress GetGlobalJSObject, which is virtual, but cannot GC |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
909586 |
Assertion failure: frame->script->code <= pc && pc < frame->script->code + frame->script->length, at vm/SPSProfiler.h |
[jsbugmon:][adv-main28+] |
FIXED |
Kannan Vijayan [:djvj] |
909972 |
Fix the remaining hazards in AsmJS |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
909997 |
Allow changing more JS compiler options at runtime |
|
FIXED |
|
910782 |
indirect-goto-based interpreter |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
911578 |
introduce self-hosting intrinsic IsPackedArray and use it for implementing optimized loops in array extras |
[qa-] |
FIXED |
Till Schneidereit [:till] |
912168 |
startup precompilation cache broken on sparc64 |
|
FIXED |
Gabriele Svelto [:gsvelto] |
912303 |
Differential Testing: Different output message involving __noSuchMethod__ |
|
FIXED |
Kannan Vijayan [:djvj] |
914141 |
Crash [@ js::Shape::isNative] with backtracking register allocation |
|
FIXED |
Dan Gohman [:sunfish] |
916255 |
Allow script loaders to have multiple in flight off thread parses |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
917454 |
[typed objs] Add objectType function |
[qa-] |
FIXED |
Niko Matsakis [:nmatsakis] |
921224 |
Minimize GCMark buffer when incremental GC is disabled. |
[MemShrink:P2] |
FIXED |
Nicholas Nethercote [inactive] |
921561 |
JS_DECLARE_NEW_METHODS should use "perfect" forwarding |
[qa-] |
FIXED |
Jeff Walden [:Waldo] |
921586 |
'may be used uninitialized' warnings in StructuredClone.cpp |
[qa-] |
FIXED |
Jim Blandy :jimb |
922048 |
Peacekeeper domJQueryBasicFilters slower than in Chrome |
|
FIXED |
Jan de Mooij [:jandem] |
922070 |
Source note table in BytecodeEmitter.cpp should be generated by higher-order macro |
[qa-] |
FIXED |
Andy Wingo [:wingo] |
922115 |
Support unsized arrays in typed objects |
[qa-] |
FIXED |
Niko Matsakis [:nmatsakis] |
922172 |
Add redimension method for typed objects |
|
FIXED |
Niko Matsakis [:nmatsakis] |
922216 |
Self-host equivalent type check |
|
FIXED |
Niko Matsakis [:nmatsakis] |
924920 |
Crash with SIGTRAP with --ion-regalloc=backtracking combined with other flags |
[fuzzblocker] |
FIXED |
general |
925308 |
Assertion failure: *(int*)size_ >= 0, at vm/SPSProfiler.cpp:196 |
[fuzzblocker] [jsbugmon:update,ignore][adv-main27+] |
FIXED |
Kannan Vijayan [:djvj] |
925309 |
Assertion failure: enable == !(bool)spsOn_, at jit/BaselineJIT.cpp:777 |
[jsbugmon:update] |
FIXED |
Kannan Vijayan [:djvj] |
925470 |
JSIL game "Soulcaster" fails to parse XML level description |
|
FIXED |
Kannan Vijayan [:djvj] |
925621 |
Let startProfiling take a pid so the content process can be profiled |
[qa-] |
FIXED |
Drew Willcoxon :adw |
925949 |
AWFY regressions: 12% Octane-Regexp on Sep 20 |
|
FIXED |
Hannes Verschore [:h4writer] |
926401 |
ASan heap-buffer-overflow with BinaryData |
[asan][fixed in bug 898362; this bug has the test] |
FIXED |
Jeff Walden [:Waldo] |
926431 |
Assertion failure: isObject(), at js/Value.h:1129 with ASM.js and clone |
[jsbugmon:update] |
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
926678 |
JSRuntime::gcMallocBytes is ignored if it doesn't trigger a GC the first time |
|
FIXED |
Jon Coppeard (:jonco) |
926710 |
PJS: Unify --thread-count shell option and JS_THREADPOOL_SIZE env var |
[qa-] |
FIXED |
Shu-yu Guo [:shu] |
926779 |
"Assertion failure: thing" with schedulegc, crypto exception |
|
FIXED |
Terrence Cole [:terrence] |
926837 |
Assertion failure: !instructions.empty(), at jit/RegisterAllocator.cpp:80 |
[jsbugmon:update,bisect,ignore] |
FIXED |
Jan de Mooij [:jandem] |
926904 |
Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Modified registers between VM call and OsiPoint)), at jit/shared/CodeGenerator-shared.cpp:532 with --ion-regalloc=backtracking |
|
FIXED |
general |
927116 |
Implement import declarations |
|
FIXED |
Eddy Bruel [:ejpbruel] |
927516 |
Worker is slower than Main Thread |
[Shumway:P1] |
FIXED |
Jan de Mooij [:jandem] |
927763 |
AWFY: asmjs-apps-box2d-workload1 regression of 15% - 20% on x86 slave on October 15th, 2013 |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
927939 |
GenerationalGC: Mochitest test_bug773962.xul crashes with assertion failure on IsBackgroundFinalized() |
|
FIXED |
Jon Coppeard (:jonco) |
928050 |
Remove worker pausing mechanism |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
928350 |
IonMonkey: call collectRangeInfo before removing the range analysis beta nodes |
[qa-] |
FIXED |
Douglas Crosher [:dougc] |
928616 |
Clean up JS_CopyPropert{ies,y}From Implementation |
[qa-] |
FIXED |
Bobby Holley (:bholley) |
928917 |
Array.prototype.slice on an array with holes is super slow |
[qa-] |
FIXED |
Masaya Iseki[:isk](UTC+9) |
929261 |
GetElementIC typed array stub doesn't property respect monitoredResult() |
[adv-main26+][adv-esr24.2+][qa-] |
FIXED |
Eric Faust [:efaust] |
929280 |
Assertion failure: efs->argCount == args.length() - 1, at vm/SelfHosting.cpp |
[fuzzblocker] [jsbugmon:update] |
FIXED |
Felix S. Klock II [:pnkfelix, :fklock] |
930048 |
Remove need to read objects directly when optimizing singleton accesses |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
930057 |
Incorrect return false in TypedObject JIT compilation |
[qa-] |
FIXED |
Niko Matsakis [:nmatsakis] |
930327 |
Assertion failure: [infer failure] Missing type in object [0xf7025480] value: bool, at jsinfer.cpp:292 |
[jsbugmon:update] |
FIXED |
Brian Hackett [Laid off!] |
930378 |
Improve rooting in Debugger |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
930411 |
Implement export declarations |
[qa-] |
FIXED |
Eddy Bruel [:ejpbruel] |
930526 |
Assertion failure: obj, at dist/include/js/Value.h:527 with OOM |
|
FIXED |
Terrence Cole [:terrence] |
930543 |
Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at dist/include/js/Value.h:406 or Crash [@ js::LoadScalarfloat::Func] or Crash [@ js::jit::BaselineScript::nativeCodeForPC] |
[jsbugmon:update][fuzzblocker] |
FIXED |
Niko Matsakis [:nmatsakis] |
930708 |
Add DoubleEqualsInt32 which accepts negative zero |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
930714 |
implement extraName() for LUnbox |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
930974 |
Assertion failure: args[0].isObject(), at builtin/TypedObject.cpp:2401 or Crash [@ js::ObjectIsTypedHandle] |
[jsbugmon:update] |
FIXED |
Niko Matsakis [:nmatsakis] |
930993 |
(jit) Dangerous Crash on Heap with Typed Arrays and GC |
[jsbugmon:update,ignore] |
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
931008 |
Assertion failure: table, at dist/include/js/HashTable.h:1353 or Crash [@ Range] |
[jsbugmon:update] |
FIXED |
Steve Fink [:sfink] [:s:] |
931151 |
Offer an alternative to NSPR when building the shell on POSIX platforms |
[qa-] |
FIXED |
Bill McCloskey [inactive unless it's an emergency] (:billm) |
931218 |
Handle an exact rooting hazard in stealContents |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
931251 |
crash in SaveSharedScriptData |
|
FIXED |
Till Schneidereit [:till] |
931328 |
IonMonkey: Optimize Math.hypot |
|
FIXED |
Sankha Narayan Guria [:sankha] |
931414 |
Assertion failure: pcdepth >= nuses, at js/src/jsopcode.cpp:1682 |
|
FIXED |
Andy Wingo [:wingo] |
931446 |
Improve comment on JS::Heap |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
931486 |
x86 assembly spew fixes |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
931487 |
Backtracking allocator: avoid spilling two different register groups to the same argument slot |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
931488 |
basic range analysis for MBoundsCheck, MArrayLength, MRandom, MMathFunction |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
931489 |
use range analysis to eliminate NaN code |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
931496 |
Assertion failure: script->canBaselineCompile(), at jit/BaselineJIT.cpp |
[jsbugmon:update][qa-] |
FIXED |
Brian Hackett [Laid off!] |
931812 |
GenerationalGC: Browser build test jittest failures: js/src/jit-test/tests/gc/bug-913261.js |
|
FIXED |
Jon Coppeard (:jonco) |
931864 |
can we remove the activeGCInAtomsZone limitation in JS::CanCompileOffThread? |
[games][qa-] |
FIXED |
Luke Wagner [:luke] |
931882 |
Jit-test test basic/bug908915.js times out on Android |
|
FIXED |
Douglas Crosher [:dougc] |
931984 |
Use baseline cache information for calling common getter/setters in Ion code |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
932025 |
'may be used uninitialized' warnings in OldDebugAPI.cpp |
[qa-] |
FIXED |
Jim Blandy :jimb |
932180 |
Rewrite decompiler's bytecode parser to not need SRC_HIDDEN annotations |
[qa-] |
FIXED |
Andy Wingo [:wingo] |
932216 |
Remove code conditional on JS_HAS_CONST, JS_HAS_BLOCK_SCOPE |
[qa-] |
FIXED |
Andy Wingo [:wingo] |
932276 |
Compute static scope extents at compile-time and store them in JSScript |
[qa-] |
FIXED |
Andy Wingo [:wingo] |
932312 |
Remove SRC_HIDDEN |
[qa-] |
FIXED |
Andy Wingo [:wingo] |
932364 |
Fix an exact rooting hazard across AddSizeOfTab |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
932440 |
Bug 918207 reinstated bug 924608 |
[qa-] |
FIXED |
nnethercote |
932530 |
Assertion failure: thing, at gc/Marking.cpp:126 or Crash [@ tenuredZone] with OOM |
|
FIXED |
Terrence Cole [:terrence] |
932757 |
Remove JSOP_POPV and JSOP_STOP |
[qa-] |
FIXED |
Hannes Verschore [:h4writer] |
932768 |
Remove vestigial decompiler hacks from BytecodeEmitter |
[qa-] |
FIXED |
Andy Wingo [:wingo] |
932769 |
AWFY: octane-mandreel regression of 16% on x86 slave on October 29th, 2013 |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
932796 |
Assertion failure: efs->argCount == args.length() - 1, at vm/SelfHosting.cpp:87 or Crash [@ __strlen_sse2_bsf] |
|
FIXED |
Felix S. Klock II [:pnkfelix, :fklock] |
932800 |
IonMonkey always bails for string[string] GETELEM |
|
FIXED |
Jan de Mooij [:jandem] |
932851 |
Use of uninitialized value created on stack: : js::Discard() (StructuredClone.cpp:351) |
|
FIXED |
Steve Fink [:sfink] [:s:] |
932875 |
Page load fails on kunagi.org |
|
FIXED |
Brian Hackett [Laid off!] |
932899 |
Remove TYPE_FLAG_STACK_SET, TYPE_FLAG_HEAP_SET |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
932940 |
Jit-test harness needs to set different remote --js-cache |
|
FIXED |
Dan Minor [:dminor] |
932991 |
build broken on OpenBSD/sparc64 after header reordering in bug 898274 |
|
FIXED |
Landry Breuil (:gaston) |
933104 |
OdinMonkey: Assertion failure: max_exponent_ + canHaveFractionalPart_ >= mozilla::FloorLog2(mozilla::Abs(upper_)), at jit/RangeAnalysis.h |
|
FIXED |
Dan Gohman [:sunfish] |
933269 |
Optimize array indices in typed objects |
[qa-] |
FIXED |
Felix S. Klock II [:pnkfelix, :fklock] |
933301 |
[].push.apply is very slow |
[performance] [shumway] |
FIXED |
Jan de Mooij [:jandem] |
933369 |
x86 emulator much slower than in Chrome |
[good first verify] |
FIXED |
Jan de Mooij [:jandem] |
933382 |
GenerationalGC: Fix the all-slots post barrier |
|
FIXED |
Terrence Cole [:terrence] |
933475 |
Array.prototype.push on a non-array-object is slow |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
933557 |
[jsdbg2] Setting a Debugger.prototype.onEnterFrame hook imposes substantial overhead |
|
FIXED |
Shu-yu Guo [:shu] |
933734 |
google drive crashes with 11/1 nightly js::ObjectImpl::nativeLookup js::jit::DoTypeMonitorFallback |
|
FIXED |
Brian Hackett [Laid off!] |
933746 |
GMail crash in JSObject::getPropertyNoGC(JSContext*, JSObject*, JSObject*, js::PropertyName*, JS::Value*) |
fixed by bug 933734 |
FIXED |
|
933760 |
Have TI track a TypeRepresentation for each type descriptor |
[qa-] |
FIXED |
Niko Matsakis [:nmatsakis] |
933764 |
Change TypeRepresentationSet to disallow access to individual members |
[qa-] |
FIXED |
Niko Matsakis [:nmatsakis] |
933776 |
crash in memcpy | JSRope::flattenInternal<int>(js::ExclusiveContext*) |
fixed by bug 933734 |
FIXED |
|
933798 |
Don't inhibit name optimizations in try blocks |
|
FIXED |
Jan de Mooij [:jandem] |
933807 |
Allow easily disabling TriggerOperationCallbackFor(Ion|AsmJS)Code |
[qa-] |
FIXED |
Luke Wagner [:luke] |
933810 |
Really remove JS_ValueToECMAUint32 |
[qa-] |
FIXED |
Tom S [:evilpie] |
933834 |
Rename and handlify JS_ValueToString |
[qa-] |
FIXED |
Tom S [:evilpie] |
933882 |
Invalidate scripts and discard JIT code instead of doing AutoDebugModeGC |
[qa-] |
FIXED |
Shu-yu Guo [:shu] |
933932 |
OdinMonkey: bad asm.js warning with unsigned form |
|
FIXED |
Luke Wagner [:luke] |
933946 |
Remove the rest of the old number conversion functions |
[qa-] |
FIXED |
Tom S [:evilpie] |
933952 |
The NO_DELTA flag in CharacterInfo is unnecessary |
[qa-] |
FIXED |
Eddy Bruel [:ejpbruel] |
934173 |
Mark debugMode() as JS_UNLIKELY |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
934174 |
Optimize the interpreter's int32 add |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
934175 |
optimize x64's extended jump table entry |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
934262 |
Fix -Wtautological-constant-out-of-range-compare warnings in js/src/jit/ |
[qa-] |
FIXED |
Chris Peterson [:cpeterson] |
934351 |
More annotations that have been in production |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
934419 |
Split CompartmentOptions off from ContextOptions |
[Shumway:m2][qa-] |
FIXED |
Eddy Bruel [:ejpbruel] |
934427 |
Crash [@ ScriptFromCalleeToken] |
[jsbugmon:update] |
FIXED |
Kannan Vijayan [:djvj] |
934442 |
GenerationalGC: mochitest test_cpows.xul assertion failure |
|
FIXED |
Jon Coppeard (:jonco) |
934485 |
Remove unused ProxyOptions::forceForegroundFinalization() |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
934500 |
Don't eagerly create callsite clones in IonBuilder |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
934520 |
undefined behavior in SafeAdd and others |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
934526 |
Don't use context to get existing intrinsic values in IonBuilder |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
934557 |
Handlify JS::ToBoolean, remove JS_ValueToBoolean |
[qa-] |
FIXED |
Tom S [:evilpie] |
934698 |
Analysis false positive with AddRef() |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
934718 |
Simplify some HashTable internal maths, kill some JS_STATIC_ASSERT usage |
[qa-] |
FIXED |
Jeff Walden [:Waldo] |
934789 |
Assertion Failure: type() != NAMED_LAMBDA in ScopeCoordinateToStaticScopeShape |
|
FIXED |
Jan de Mooij [:jandem] |
934799 |
Make turning on debug mode for all compartments not delazify all lazy scripts |
[qa-] |
FIXED |
Shu-yu Guo [:shu] |
934990 |
unresolved external symbol in debug builds when calling shadow::Zone::runtimeFromMainThread from browser |
[qa-] |
FIXED |
Andrew McCreight [:mccr8] |
934997 |
Assertion failure: !empty(), at ../vm/Shape.h:1030 or Crash [@ js::ScopeCoordinateName] |
[jsbugmon:update] |
FIXED |
Jan de Mooij [:jandem] |
935006 |
Assertion failure: slotInRange(slot), at ../vm/ObjectImpl.h:1339 or Crash [@ getSlotAddressUnchecked] |
[fuzzblocker] [jsbugmon:update] |
FIXED |
Jan de Mooij [:jandem] |
935016 |
IonMonkey: Specialize string.split(string) |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
935022 |
GenerationalGC: Assertion failure: currentEnd_ == chunk(currentChunk_).end(), at ../gc/Nursery.h:199 |
[jsbugmon:ignore] |
FIXED |
Jon Coppeard (:jonco) |
935027 |
Don't create 'rest' template objects in IonBuilder |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
935032 |
Remove remaining uses of JSContext in IonBuilder |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
935125 |
Whitelist PLDHashTableOps.hashKey |
|
FIXED |
Steve Fink [:sfink] [:s:] |
935130 |
mem.log console message should say "Zones Collected" not "Compartments Collected" |
|
FIXED |
Andrew McCreight [:mccr8] |
935136 |
GenerationalGC: Heap<Value> can cause use-after-free |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
935156 |
Fix the new exact rooting hazards in jsopcode.cpp |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
935173 |
Fix JS_NeuterArrayBuffer and call it |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
935228 |
JSD.pause and unPause can attempt to toggle debug traps on non-debug mode Baseline scripts |
[adv-main27-] exploit requires Firebug plus a malicious addon that uses Firebug |
FIXED |
Shu-yu Guo [:shu] |
935271 |
Fix OSX #ifdefs and remove OS/2 support from gc/Memory.cpp |
|
FIXED |
Terrence Cole [:terrence] |
935322 |
(jit) Crash on Heap near [@ EnterBaseline] |
[fuzzblocker] [jsbugmon:update] |
FIXED |
Jan de Mooij [:jandem] |
935324 |
Clean up adding of type properties to objects |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
935331 |
Assertion failure: is<CallObject>() || is<ClonedBlockObject>(), at ../vm/ScopeObject.h:771 or Assertion failure: type() != NAMED_LAMBDA, at vm/ScopeObject.cpp:74 or Crash on Heap |
[fuzzblocker] [jsbugmon:update] |
FIXED |
Jan de Mooij [:jandem] |
935338 |
Get NSPR emulation working on Macs |
[qa-] |
FIXED |
Bill McCloskey [inactive unless it's an emergency] (:billm) |
935348 |
crash in Interpret |
|
FIXED |
Jan de Mooij [:jandem] |
935586 |
Fix an exact rooting hazard in getIntrinsicValue |
|
FIXED |
Terrence Cole [:terrence] |
935791 |
Add an option to disable SSE3 and SSE4 code generation on the JS shell |
[qa-] |
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
935800 |
Fix an exact rooting false positive in ForkJoinSlice |
|
FIXED |
Terrence Cole [:terrence] |
935903 |
GC: SharedScriptData is not unmarked if a collection is reset |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
935952 |
Assertion failure: !unknownProperties(), at c:\work\mozilla\builds\aurora\mozilla\js\src\jsinferinlines.h:1396 |
|
FIXED |
Brian Hackett [Laid off!] |
935999 |
IonMonkey: add-property stub: support type checks |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
936004 |
Assertion failure: is<CallObject>() || is<ClonedBlockObject>(), at ../vm/ScopeObject.h:771 Crash [@ slotSpan] or Crash [@ js::jit::MacroAssembler::initGCThing] |
[fuzzblocker] [jsbugmon:update] |
FIXED |
Brian Hackett [Laid off!] |
936013 |
Assertion failure: is<T>(), at ../jsobj.h:1156 or Crash [@ getClass] with neuter |
[jsbugmon:update] |
FIXED |
Steve Fink [:sfink] [:s:] |
936040 |
Fix an exact rooting false positive in nsWindowSH::PostCreate |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
936143 |
Fix js_GetScriptLineExtent. (r=?) |
[qa-] |
FIXED |
Shu-yu Guo [:shu] |
936232 |
js_InitTypedObjectClass is not APPLICATION_SLOTS-aware, and clobbers the DataView constructor |
[qa-] |
FIXED |
Bobby Holley (:bholley) |
936234 |
Inline n-Ary Math.min and Math.max |
[Shumway][qa-] |
FIXED |
Sean Stangl [:sstangl] |
936341 |
Get NSPR emulation working on BSD |
|
FIXED |
Feiko Koopman |
936361 |
Assertion failure: (!property.isOwnProperty(constraints())), at jit/IonBuilder.cpp |
[jsbugmon:update] |
FIXED |
Brian Hackett [Laid off!] |
936403 |
Crash [@ operator] or [@ JSObject::nativeSetSlotWithType] or Assertion failure: obj, at dist/include/js/Value.h |
[jsbugmon:] |
FIXED |
Brian Hackett [Laid off!] |
936431 |
Fix tracelogger after CompileOptions changes |
[qa-] |
FIXED |
Hannes Verschore [:h4writer] |
936455 |
GetElementIC::update should call GetObjectElementOperation instead of GetElementOperation |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
936501 |
Only give IonBuilder a context during definite properties analysis |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
936514 |
GC: In source documentation on the collector needs updating |
|
FIXED |
Jon Coppeard (:jonco) |
936583 |
Move common fields of the chunk footer to a common struct |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
936681 |
jit-test error output doesn't print stderr like it's supposed to |
|
FIXED |
Bill McCloskey [inactive unless it's an emergency] (:billm) |
936698 |
The testIntTypesABI header list is woefully out of date |
[qa-] |
FIXED |
Andrew McCreight [:mccr8] |
936710 |
Add an option to propagate flags to nested shells |
[qa-] |
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
936737 |
Crash with SIGTRAP involving --ion-check-range-analysis |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
936854 |
Assertion failure: !isOwned() && !unowned_, at vm/Shape.h |
[jsbugmon:update] |
FIXED |
Brian Hackett [Laid off!] |
936891 |
Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Modified registers between VM call and OsiPoint)), at jit/shared/CodeGenerator-shared.cpp:532 |
|
FIXED |
Dan Gohman [:sunfish] |
936966 |
Assertion failure: !aheader->hasFreeThings(), at jsgc.h:528 Assertion failure: !(addr & ArenaMask), at ../gc/Heap.h:847 or Crash [@ GetGCThingMarkBitmap] |
[jsbugmon:update] |
FIXED |
Brian Hackett [Laid off!] |
936993 |
reduce register pressure around MCheckOverRecursed |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
937012 |
Improve vanilla allocation/free checking in SpiderMonkey |
|
FIXED |
Nicholas Nethercote [inactive] |
937058 |
Paper over debug-mode checks of stack depth for unreachable bytecode |
|
FIXED |
Andy Wingo [:wingo] |
937083 |
Assertion failure: !cx->isExceptionPending(), at ../jscntxtinlines.h:223 with OOM in js::CallJSNative |
|
FIXED |
Christian Holler (:decoder) |
937121 |
Register allocation debugging aids |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
937124 |
Refactor some backtracking allocator code to use isRegisterUse |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
937128 |
Backtracking allocator: minor code cleanups |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
937391 |
Refactor typed object element / property access |
[qa-] |
FIXED |
Niko Matsakis [:nmatsakis] |
937404 |
Possible buffer size miscalculation in JS::NotableStringInfo |
[qa-] |
FIXED |
Jim Blandy :jimb |
937540 |
Use placement new syntax for JIT temporary memory allocations |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
937550 |
Report OOM to stderr in JS_MORE_DETERMINISTIC builds |
|
FIXED |
Jan de Mooij [:jandem] |
937605 |
Firefox fails to build on PPC64: GCInternals.h:29:5: error: ‘ZoneSelector’ does not name a type |
|
FIXED |
Gregor Wagner [:gwagner] |
937674 |
Don't instantiate types when adding type object guards around type write barriers |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
937763 |
getPropTryCommonGetter is emitting unnecessary moves |
|
FIXED |
Shu-yu Guo [:shu] |
937772 |
Should emit an infallible unbox in pushTypeBarrier when we can |
|
FIXED |
Boris Zbarsky [:bzbarsky] |
937916 |
Implement TrueValue() and FalseValue() |
[qa-] |
FIXED |
Michael |
937944 |
Make ARM's scratch float register different from its argument registers |
|
FIXED |
Dan Gohman [:sunfish] |
938130 |
Assertion failure: returnAddr < method_->raw() + method_->instructionsSize(), at jit/BaselineJIT.cpp:573 or Crash [@ GetBytecodeLength] with parallel compilation |
|
FIXED |
Kannan Vijayan [:djvj] |
938211 |
GenerationalGC: Heap<T> does not supply copy assignment operator |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
938212 |
GenerationalGC: Iterator prototype objects should be tenured |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
938390 |
don't create a string to hold chars in ScriptSource::chars |
[qa-] |
FIXED |
Luke Wagner [:luke] |
938431 |
Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp |
[jsbugmon:update][adv-main27+] |
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
938468 |
Backtracking allocator: miscompile on ss-aes on ARM |
|
FIXED |
Douglas Crosher [:dougc] |
938615 |
avoid GC hazard in ScriptSource::substring |
[adv-main28+] |
FIXED |
Luke Wagner [:luke] |
938728 |
Implement basic support for float32x4 as a typed object constructor |
[qa-][DocArea=JS] |
FIXED |
Niko Matsakis [:nmatsakis] |
938907 |
Get rid of the compileAndGo flag in ContextOptions |
|
FIXED |
Eddy Bruel [:ejpbruel] |
938950 |
Don't provide full access to compartment/zone/runtime when compiling off thread |
[qa-] |
FIXED |
|
939015 |
"Assertion failure: !parent->inDictionary()" looping over huge string |
|
FIXED |
Shu-yu Guo [:shu] |
939088 |
massive regression in testClosureAssign |
|
FIXED |
Brian Hackett [Laid off!] |
939206 |
GenerationalGC: Postbarriers are broken for nsTArrays of JS::Values |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
939274 |
Change jit-tests remote harness to push tests/* to remote device |
|
FIXED |
Dan Minor [:dminor] |
939410 |
JSON.parse() return incorrect error position |
|
FIXED |
Masaya Iseki[:isk](UTC+9) |
939420 |
neuter() returns itself |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
939464 |
warning: ‘*((void*)(& c)+16).js::CompartmentsInZoneIter::it’ may be used uninitialized in this function [-Wmaybe-uninitialized] |
[qa-] |
FIXED |
:Benjamin Peterson |
939471 |
Typo in gcparam() error message |
[qa-] |
FIXED |
Michael |
939472 |
"Assertion failure: view" with gcslice and neuter |
[fuzzblocker:neuter][adv-main27+] |
FIXED |
Steve Fink [:sfink] [:s:] |
939475 |
gcparam() help and error message do not mention markStackLimit |
[qa-] |
FIXED |
Michael |
939476 |
"Assertion failure: phases[phase].parent == parent" with gcparam('markStackLimit') |
|
FIXED |
Jon Coppeard (:jonco) |
939504 |
Leftover <CanGC> Template on AtomizeChars in BIG ENDIAN case breaking the build |
|
FIXED |
Landry Breuil (:gaston) |
939546 |
zone iterators should have explicit constructors |
[qa-] |
FIXED |
:Benjamin Peterson |
939816 |
IonMonkey: Support inlining JSOP_THROW |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
939820 |
LNop and LLabel are not needed for backtracking register allocator |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
939824 |
Factor out the backtracking allocator's splitting logic |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
939835 |
tcanvasmark regression detected on osx and windows platforms |
[talos_regression][qa-] |
FIXED |
Boris Zbarsky [:bzbarsky] |
939868 |
IonMonkey: Incorrect result for (x || Math.fround(y)) |
|
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
939893 |
"Assertion failure: !minimalInterval(interval)" in backtracking allocator |
|
FIXED |
Dan Gohman [:sunfish] |
939993 |
GenerationalGC: HashMap AddPtr API abuse misplaces hash table entries |
|
FIXED |
Jon Coppeard (:jonco) |
940033 |
js::HashMapEntry::key should be non-const, but private, with read-only accessor |
[qa-] |
FIXED |
Jeff Walden [:Waldo] |
940088 |
Assertion failure: jit::IsIonEnabled(cx), at jit/Ion.cpp |
[jsbugmon:] |
FIXED |
Shu-yu Guo [:shu] |
940131 |
Crash with SIGTRAP involving ArrayType |
[jsbugmon:] |
FIXED |
Niko Matsakis [:nmatsakis] |
940246 |
Cross-compiling 32-bit shell in Mac OS X 10.9 no longer seems to work |
[fuzzblocker] |
FIXED |
Makoto Kato [:m_kato] |
940285 |
Build failed with JS_ION off |
[qa-] |
FIXED |
Kan-Ru Chen [:kanru] (UTC+9) |
940441 |
js/src/tests/ecma_6/TypedObject/Bug914137.js causes OOM failures on Android x86 emulator |
|
FIXED |
Geoff Brown [:gbrown] |
940525 |
Fix Baseline typed array stubs to handle double indexes |
|
FIXED |
Jan de Mooij [:jandem] |
940558 |
Fix an exact rooting false positive in replaceLastProperty |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
940591 |
Build parts of js/src in unified mode |
[qa-] |
FIXED |
(no longer active) |
940629 |
Root StackShape across getChildPropertyOnDictionary calls |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
940635 |
IonMonkey: (false == null) incorrectly evaluates to true |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
940642 |
IonMonkey: Incorrect result for multiplication when also calling imul |
|
FIXED |
Tom S [:evilpie] |
940686 |
When eliminating barriers in TryEliminateTypeBarrierFromTest, also make the input unbox (if any) infallible |
|
FIXED |
Boris Zbarsky [:bzbarsky] |
940718 |
Mark AutoJSContext as not GCing (and make this true) |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
940755 |
Suppress AutoAssertNoGC scopes |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
940846 |
Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp |
[jsbugmon:update] |
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
940852 |
Record baseline frame information before Ion compilation |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
940864 |
OdinMonkey: Incorrect result with >>> % >> |
|
FIXED |
Dan Gohman [:sunfish] |
940925 |
IonMonkey: Don't inspect baseline binary arithmetic IC if it had unoptimizable operands |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
940972 |
Uint8ClampedArray doesn't clamp correctly in baseline |
[qa-] |
FIXED |
Nicolas B. Pierron [:nbp — off until 29-09] |
941028 |
IonMonkey: Don't inline in big functions |
[qa-] |
FIXED |
Hannes Verschore [:h4writer] |
941247 |
Zone::CompartmentGCState should be named Zone::GCState |
[qa-] |
FIXED |
Jim Blandy :jimb |
941262 |
AutoAssertNoGC with no runtime |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
941311 |
Improve GGC pretenuring heuristics |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
941381 |
IonMonkey: Incorrect fround(asin()) |
[qa-] |
FIXED |
Benjamin Bouvier [:bbouvier] (inactive) |
941424 |
Build more of the JS engine in unified mode |
[qa-] |
FIXED |
(no longer active) |
941590 |
Build jsapi-tests in unified mode |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
941617 |
Backtracking allocator: Fix an Osi point clobber in ComputeThis |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
941649 |
Multiple jit-tests fail on single core ARM target. (mostly parallel tests) |
|
FIXED |
Felix S. Klock II [:pnkfelix, :fklock] |
941652 |
Fix quadradic algorithm in backtracking allocator |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
941672 |
Fix jit-tests on linux ec2 test machines |
|
FIXED |
Felix S. Klock II [:pnkfelix, :fklock] |
941779 |
Fix an opt no-debug build error in ggc builds |
|
FIXED |
Terrence Cole [:terrence] |
941792 |
Make sure decommitting actually works on B2G |
[MemShrink:P1] |
FIXED |
Ting-Yuan Huang |
941793 |
GenerationalGC: Store buffer entries are not always removed on relocation |
|
FIXED |
Jon Coppeard (:jonco) |
941803 |
SpiderMonkey --enable-perf builds broken by C++ rvalue reference patch |
|
FIXED |
Jim Blandy :jimb |
941821 |
Fix an exact rooting hazard false positive across ForkJoin invocation |
|
FIXED |
Terrence Cole [:terrence] |
941827 |
Use off-main-thread parsing even if GetCPUCount() == 1 |
|
FIXED |
Luke Wagner [:luke] |
941837 |
js::gc::MapAlignedPages causes virtual address space fragmentation on Windows |
[MemShrink] |
FIXED |
Terrence Cole [:terrence] |
941877 |
OdinMonkey: Crash [@ js::jit::CodeGeneratorX86Shared::bailout] or Assertion failure: isDiv(), at jit/MIR.h |
[jsbugmon:update][qa-] |
FIXED |
Dan Gohman [:sunfish] |
941905 |
OdinMonkey: Crash [@ js::jit::SplitCriticalEdges] or Assertion failure: GetARMFlags() <= ((4294967295U) >> ARCH_BITS), at jit/AsmJSModule.cpp |
[fuzzblocker] |
FIXED |
Douglas Crosher [:dougc] |
942027 |
Assertion failure: isObject(), at dist/include/js/Value.h or Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at dist/include/js/Value.h or Assertion failure: v.isUndefined(), at jsnum.cpp |
[fuzzblocker] |
FIXED |
Douglas Crosher [:dougc] |
942105 |
IonMonkey: Remove bogus inlineUseCountRatio |
[qa-] |
FIXED |
Hannes Verschore [:h4writer] |
942116 |
Stop using the register keyword in the JS engine |
[qa-] |
FIXED |
(no longer active) |
942122 |
Build the JS gdb tests in unified mode |
[qa-] |
FIXED |
(no longer active) |
942124 |
Build the js shell in unified mode |
[qa-] |
FIXED |
(no longer active) |
942127 |
Build the JS editline library in unified mode |
[qa-] |
FIXED |
(no longer active) |
942205 |
Initialize ParallelArray class in GlobalObject::initStandardClasses. |
[qa-] |
FIXED |
Till Schneidereit [:till] |
942211 |
Remove usages of NewObjectWithClassProto |
[qa-] |
FIXED |
Till Schneidereit [:till] |
942236 |
Optimize unsigned div, mod, and ursh |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
942258 |
Assertion failure: mir->canBeDivideByZero(), at jit/shared/CodeGenerator-x86-shared.cpp |
[jsbugmon:update] |
FIXED |
Dan Gohman [:sunfish] |
942304 |
Avoid rooting hazard in ArrayBufferObject::neuterViews |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
942346 |
Bug 933882 broke non-ion builds |
|
FIXED |
Shu-yu Guo [:shu] |
942354 |
GC: Remove NAME_ALL_GC_ROOTS #define |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
942376 |
Make "quit" and "terminate" print a message indicating they were called, in more-deterministic builds |
|
FIXED |
Jan de Mooij [:jandem] |
942390 |
Differential Testing: Different output message involving __iterator__ |
|
FIXED |
Jan de Mooij [:jandem] |
942421 |
Since bugfix for 941424, xpcshell built with gcc 4.8.2 is broken in packaging process |
[qa-] |
FIXED |
(no longer active) |
942480 |
Crash [@ js::gc::Cell::runtimeFromAnyThread] or Assertion failure: table, at dist/include/js/HashTable.h or Assertion failure: object->runtimeFromMainThread()->isHeapBusy(), at vm/Debugger.cpp |
[MemShrink] |
FIXED |
Shu-yu Guo [:shu] |
942549 |
Differential Testing: Different output message involving eval, -0 |
|
FIXED |
Shu-yu Guo [:shu] |
942552 |
Unified sources causing build issues in SpiderMonkey with --disable-threadsafe |
[fuzzblocker] |
FIXED |
(no longer active) |
942604 |
Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp |
[jsbugmon:update] |
FIXED |
Kannan Vijayan [:djvj] |
942871 |
Convert trySplitAtLastRegisterUse to use splitAt |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
942903 |
BitAndAndBranch can use its operands AtStart |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
942928 |
GenerationalGC: Browser opt builds fail with undefined reference to `JS::HeapCellRelocate(js::gc::Cell**)' |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
942984 |
Emscripten web page hard-crashes the browser. |
|
FIXED |
Brian Hackett [Laid off!] |
943126 |
Fast-path for String.split("") |
[qa-] |
FIXED |
Sean Stangl [:sstangl] |
943327 |
Octane-mandreel spends a lot of time in ValueNumberer::lookupValue |
|
FIXED |
Jan de Mooij [:jandem] |
943347 |
Build js/jsd in unified mode |
[qa-] |
FIXED |
(no longer active) |
943425 |
Avoid creating empty MoveGroups |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
943429 |
Misc register allocation cleanups |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
943436 |
Refactor BacktrackingAllocator::processInterval |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
943449 |
Consistent dump() methods for Ion objects |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
943667 |
AsmJSModule can try to remove dependencies which were never successfully added in the first place |
[qa-] |
FIXED |
Hannes Verschore [:h4writer] |
943723 |
Nightly hangs with this test case (typed objects) |
[qa-] |
FIXED |
Niko Matsakis [:nmatsakis] |
943744 |
Minimize memory consumed while dumping memory reports to file |
[MemShrink][qa-] |
FIXED |
Nicholas Nethercote [inactive] |
943827 |
GC: Out of memory memory handling for buffering gray roots is broken |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
943839 |
JS_AnchorPtr doesn't, due to compiler optimizations (inlining or removing call without side effects) |
[qa-] |
FIXED |
Jeff Walden [:Waldo] |
943924 |
tp5o private bytes -regression on windows xp and windows 7 |
[talos_regression][qa-] |
FIXED |
Brian Hackett [Laid off!] |
943989 |
Incorrect generation guard done in GenerateDOMProxyChecks in the baseline compiler |
[qa-] |
FIXED |
Boris Zbarsky [:bzbarsky] |
944040 |
Do not fire post-barriers during moving GC |
[mem][qa-] |
FIXED |
Terrence Cole [:terrence] |
944080 |
Assertion failure: false, at ../vm/SelfHosting.cpp:136 with "non-canonical BestAvailableLocale locale" |
[jsbugmon:update][qa-] |
FIXED |
Brian Hackett [Laid off!] |
944196 |
Rest arguments JIT code doesn't set ObjectElements::length |
[qa-] |
FIXED |
Jeff Walden [:Waldo] |
944266 |
Differential Testing: Different output message involving __iterator__, arguments |
[qa-] |
FIXED |
|
944278 |
OdinMonkey: Crash [@ js::Invoke] |
[fuzzblocker][qa-][adv-main27+] |
FIXED |
Hannes Verschore [:h4writer] |
944379 |
Build js/ipc in unified mode |
[qa-] |
FIXED |
(no longer active) |
944438 |
Get rid of InstallSignalHandlersMutex |
[qa-] |
FIXED |
Catalin Iacob |
944444 |
Fix js/ compilation on mingw. |
[qa-] |
FIXED |
Jacek Caban |
944491 |
Add null-checking asserts to GetGCThingRuntime and GetGCThingMarkBitmap |
[qa-] |
FIXED |
Andrew McCreight [:mccr8] |
944930 |
Remove blockIndex from aliasedvar ops |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
944946 |
Use accessor methods for script->code and script->length |
[qa-] |
FIXED |
Brian Hackett [Laid off!] |
944963 |
Assertion failure: !minimalInterval(interval), at jit/BacktrackingAllocator.cpp |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
945077 |
js/src/jit/AsmJSSignalHandlers.cpp:931:13: warning: unused variable 'sHandlersInstalled' [-Wunused-variable] |
[qa-] |
FIXED |
Chris Peterson [:cpeterson] |
945294 |
Assertion failure: is<T>(), at ../jsobj.h:1169 |
|
FIXED |
Jan de Mooij [:jandem] |
945360 |
Fix three recently added hazards in spidermonkey |
[qa-] |
FIXED |
Terrence Cole [:terrence] |
945406 |
Move maybeAddOsrTypeBarriers calls from traverseBytecode to IonBuilder::build |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
945437 |
Fix Compile usecount check |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
945564 |
Move DataAlignment static const to function scope for unified build. |
[qa-] |
FIXED |
Shu-yu Guo [:shu] |
945568 |
Crash [@ ensureLinear] due to OOM in ReadFile |
[jsbugmon:update] |
FIXED |
Christian Holler (:decoder) |
945651 |
Comparison of 0 and null returns true |
|
FIXED |
|
945754 |
Assertion failure: !cx->isExceptionPending(), at ../vm/Interpreter.cpp:3468 due to OOM |
|
FIXED |
Christian Holler (:decoder) |
945811 |
Assertion failure: !analysisContext->isExceptionPending(), at jit/IonBuilder.cpp:3868 |
|
FIXED |
Jan de Mooij [:jandem] |
945826 |
Every proxy trap |foo| must either use AutoEnterPolicy in Proxy::foo or be overridden in SecurityWrapper<Base> |
[qa-] |
FIXED |
Bobby Holley (:bholley) |
945844 |
GenerationalGC: Fix a couple of problems in browser builds |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
945846 |
GenerationalGC: Store buffer reentrancy assertion fails in browser builds |
[qa-] |
FIXED |
Jon Coppeard (:jonco) |
945860 |
Assertion failure: mir->canBeDivideByZero() || (!mir->isUnsigned() && mir->canBeNegativeDividend()), at jit/shared/CodeGenerator-x86-shared.cpp |
|
FIXED |
Dan Gohman [:sunfish] |
945939 |
Use-after-free or worse in ValueNumberer::lookupValue |
[qa-][adv-main27+][adv-esr24.3+] |
FIXED |
Terrence Cole [:terrence] |
946234 |
Crash [@ js::jit::CodeGeneratorX86Shared::bailout<js::jit::BailoutJump>] |
[jsbugmon:update] |
FIXED |
Dan Gohman [:sunfish] |
946284 |
Kraken stanford-crypto-ccm fails with --ion-eager |
[qa-] |
FIXED |
Dan Gohman [:sunfish] |
946405 |
js/src/jsinfer.cpp:581:14: warning: ‘js::types::CompilerConstraintList’ has a field ‘js::types::CompilerConstraintList::constraints’ whose type uses the anonymous namespace [enabled by default], and similar in jsopcode.cpp |
[qa-] |
FIXED |
Daniel Holbert [:dholbert] |
946662 |
Add MOZ_FINAL to MResumePoint |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
946883 |
Some timeout related jit-tests fail on OS X with NSPR emulation |
[qa-] |
FIXED |
Jan de Mooij [:jandem] |
946885 |
intermittent "TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/parallel/bailout-executed.js", with "bailout-executed.js:17:0 Error: ForkJoin: compilation required in par or bailout mode" |
[qa-] |
FIXED |
|
946969 |
Differential Testing: Different output message involving Math.abs and Math.tan |
[fuzzblocker] |
FIXED |
Douglas Crosher [:dougc] |
947188 |
Jit: Add a way to bake MOZ_ASSUME_UNREACHABLE in generated code. |
[qa-] |
FIXED |
Hannes Verschore [:h4writer] |
947400 |
Make the analysis consider whether a virtual call can GC when all targets are known |
[qa-] |
FIXED |
Steve Fink [:sfink] [:s:] |
947603 |
IonMonkey: preparation for optimization levels |
[qa-] |
FIXED |
Hannes Verschore [:h4writer] |
947661 |
Crash at a weird memory address with [@ EnterBaseline] or [@ js::jit::EnterBaselineMethod] on the stack |
[jsbugmon:update] |
FIXED |
Brian Hackett [Laid off!] |
947703 |
crash in EnterBaseline at startup |
[fixed by bug 947661] |
FIXED |
Brian Hackett [Laid off!] |