Closed
Bug 700300
Opened 13 years ago
Closed 13 years ago
[ObjShrink]: Assertion failure: pobj == found, at jsinterp.cpp:1456
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: bhackett1024)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
5.71 KB,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on jaegermonkey branch revision 1210706b4576 (run with -m -n), tested on 64 bit:
for (let j = 0; j < (2); ++(__lookupSetter__)) {
function g() { j; }
}
|
Assignee | |
Comment 1•13 years ago
|
||
Erk, the DELEGATE bit wasn't ever being set when marking objects as parents of one another, as required by the teleporting optimization. FWIW, I'd like to remove the teleporting optimization pretty soon --- it has a higher cost now that it requires new shapes to be created for every delegate, and doesn't really buy much given TI. https://hg.mozilla.org/projects/jaegermonkey/rev/33962bb21403
Assignee: general → bhackett1024
Attachment #573046 -
Flags: review?(luke)
|
|
Assignee | |
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
||
Updated•13 years ago
|
Attachment #573046 -
Flags: review?(luke) → review+
|
Reporter | |
Comment 2•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug700300.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•