Assertion failure: !ObjectMayHaveExtraIndexedProperties(obj), at jit/VMFunctions.cpp:405

RESOLVED FIXED in mozilla34

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla34
x86
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox34 affected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

3 years ago
The following testcase asserts on mozilla-central revision cd2acc7ab2f8 (run with --no-threads --fuzzing-safe --ion-eager):


Object.defineProperty(Object.prototype, "0", {
    configurable: true
});
delete Object.prototype[0];
function A(a) { this.a = a; }
function B(b) { this.b = b; }
function C(c) {}
function makeArray(n) {
    var classes = [A, B, C];
    var arr = [];
    for (var i = 0; i < n; i++) {
        arr.push(new classes[i % 3](i % 3));
    }
}
var arr = makeArray(30000);
(Reporter)

Comment 1

3 years ago
Created attachment 8477682 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

3 years ago
status-firefox34: --- → affected
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

3 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 2

3 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a4877238de09
user:        Jan de Mooij
date:        Thu Aug 21 18:51:40 2014 +0200
summary:     Bug 1056795 - Optimize ArrayPushDense. r=bhackett

This iteration took 623.193 seconds to run.
(Reporter)

Comment 3

3 years ago
Needinfo from Jan based on comment 2 :)
Flags: needinfo?(jdemooij)
(Assignee)

Comment 4

3 years ago
Created attachment 8477841 [details] [diff] [review]
Patch

Bogus assert. ObjectMayHaveExtraIndexedProperties returns true because Object.prototype has obj->indexed() == true. But the type information for the property does not reflect this because it's instantiated after the property has been deleted:

Object.defineProperty(Object.prototype, "0", {configurable: true});
delete Object.prototype[0];
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Attachment #8477841 - Flags: review?(bhackett1024)
Flags: needinfo?(jdemooij)
Attachment #8477841 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 5

3 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/68bb8434fbec
https://hg.mozilla.org/mozilla-central/rev/68bb8434fbec
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
You need to log in before you can comment on or make changes to this bug.