Closed
Bug 559401
Opened 14 years ago
Closed 14 years ago
set/delete sequence assert fails (and breaks in operator)
Categories
(Tamarin Graveyard :: Virtual Machine, defect, P2)
Tracking
(Not tracked)
RESOLVED
FIXED
Q3 11 - Serrano
People
(Reporter: pnkfelix, Unassigned)
References
Details
Attachments
(1 file, 3 obsolete files)
147 bytes,
text/plain
|
Details |
the following code: var arr = [] arr[1] = 1 delete arr[1] arr[0] = 1 delete arr[0] if (1 in arr) print("whaaa") Prints "whaaa" in a non-debug build (both in tr and tr-argo). On a debug build, it signals the following assertion failure: Assertion failed: "((ScriptObject::hasUintProperty (m_lowHTentry)))" ("/Users/fklockii/Dev/tamarin-redux/core/ArrayObject.cpp":80) I found this while working on bug 559321
Reporter | ||
Comment 1•14 years ago
|
||
(provide a bit more info about context)
Attachment #439056 -
Attachment is obsolete: true
Reporter | ||
Comment 2•14 years ago
|
||
(oops previous attach was for another ticket)
Attachment #439059 -
Attachment is obsolete: true
Reporter | ||
Comment 3•14 years ago
|
||
(... and i managed to screw up the last attachment too, sorry)
Attachment #439060 -
Attachment is obsolete: true
Reporter | ||
Comment 4•14 years ago
|
||
This test case isn't perfect yet, because it should probably be separating modifications to a freshly allocatoin (clean) object/array/etc from modifications to one that has already undergone a series of modifications. The current test bangs on one entity repeatedly; this is indeed important to test (see bug 559401) but so is the other case.
Reporter | ||
Comment 5•14 years ago
|
||
The assertion in ArrayObject::checkForSparseToDenseConversion seems bogus: the m_lowHTentry tracks the smallest element in the hash table, but AFAICT that element may be the DELETED sentinel. So its not okay to assume that ScriptObject::hasUintProperty will be true for such an index. (There is still the other bug to resolve, but this assertion should go away.)
Reporter | ||
Comment 6•14 years ago
|
||
As discussed in bug 559565, the assertion need not be bogus, *if* we change the code to maintain the invariant that checkForSparseToDenseConversion is assuming -- namely that m_lowHTentry never points to a deleted sentinel node. The patches posted to bug 559565 ensure that del*Property enforces this rule, and in the process fix this bug.
Please confirm if this issue occurs in Coral or is an injection.
Target Milestone: --- → flash10.2
Reporter | ||
Comment 8•14 years ago
|
||
Issue occurs in Coral.
Updated•14 years ago
|
Priority: -- → P2
Reporter | ||
Comment 9•14 years ago
|
||
Since the fix to bug 559565 has been pushed, I think this can be resolved.
Reporter | ||
Updated•14 years ago
|
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Updated•13 years ago
|
Flags: flashplayer-bug+
You need to log in
before you can comment on or make changes to this bug.
Description
•