Closed Bug 1064159 Opened 8 years ago Closed 8 years ago

Shumway hits SpiderMonkey assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla35
Tracking Status
firefox34 --- unaffected
firefox35 --- affected

People

(Reporter: cpeterson, Assigned: bhackett1024)

References

Details

(Keywords: assertion, regression, reproducible)

Attachments

(2 files)

Brian: this assertion failure is a regression from your "Singleton type set fix" bug 1041688 comment 40:

https://hg.mozilla.org/integration/mozilla-inbound/rev/7b20a4e9ce15

I saw hits assertion failure after the new (TypeScript) version of Shumway was merged to mozilla-central on 2014-08-05 (bug 1061888).

STR:
1. Enable Shumway by flipping about:config pref "shumway.disabled" to false.
2. Running a debug build, load Flash site http://www.zombo.com

RESULT:

Assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234
Blocks: 1041688
No longer blocks: 618690
Flags: needinfo?(bhackett1024)
Keywords: regression
Summary: Shumway hits assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234 → Shumway hits SpiderMonkey assertion failure: !unknownProperties(), at js/src/jsinferinlines.h:1234
Attached patch patchSplinter Review
The APIs for updating type properties are pretty convoluted and after this lands I'll write a patch to clean them up.
Assignee: nobody → bhackett1024
Attachment #8487943 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #8487943 - Flags: review?(jdemooij) → review+
Blocks: 1066652
https://hg.mozilla.org/mozilla-central/rev/d3f70a7f2386
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.