Closed
Bug 1057582
Opened 10 years ago
Closed 10 years ago
Assertion failure: !ObjectMayHaveExtraIndexedProperties(obj), at jit/VMFunctions.cpp:405
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla34
Tracking | Status | |
---|---|---|
firefox34 | --- | affected |
People
(Reporter: decoder, Assigned: jandem)
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
343 bytes,
text/plain
|
Details | |
1.22 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on mozilla-central revision cd2acc7ab2f8 (run with --no-threads --fuzzing-safe --ion-eager): Object.defineProperty(Object.prototype, "0", { configurable: true }); delete Object.prototype[0]; function A(a) { this.a = a; } function B(b) { this.b = b; } function C(c) {} function makeArray(n) { var classes = [A, B, C]; var arr = []; for (var i = 0; i < n; i++) { arr.push(new classes[i % 3](i % 3)); } } var arr = makeArray(30000);
Reporter | ||
Comment 1•10 years ago
|
||
Reporter | ||
Updated•10 years ago
|
status-firefox34:
--- → affected
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 2•10 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/a4877238de09 user: Jan de Mooij date: Thu Aug 21 18:51:40 2014 +0200 summary: Bug 1056795 - Optimize ArrayPushDense. r=bhackett This iteration took 623.193 seconds to run.
Assignee | ||
Comment 4•10 years ago
|
||
Bogus assert. ObjectMayHaveExtraIndexedProperties returns true because Object.prototype has obj->indexed() == true. But the type information for the property does not reflect this because it's instantiated after the property has been deleted: Object.defineProperty(Object.prototype, "0", {configurable: true}); delete Object.prototype[0];
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Attachment #8477841 -
Flags: review?(bhackett1024)
Flags: needinfo?(jdemooij)
Updated•10 years ago
|
Attachment #8477841 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Comment 5•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/68bb8434fbec
Comment 6•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/68bb8434fbec
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
You need to log in
before you can comment on or make changes to this bug.
Description
•