Closed
Bug 527805
Opened 15 years ago
Closed 14 years ago
"Assertion failure: scope->object == obj2, at ../jstracer.cpp:11212" with JIT and JSCLASS_SHARE_ALL_PROPERTIES
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jorendorff, Assigned: jorendorff)
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file, 1 obsolete file)
4.39 KB,
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
See attached jsapi-test. This is a JSAPI-only bug if (as mxr claims) JSCLASS_SHARE_ALL_PROPERTIES is unused in Mozilla.
Assignee | ||
Comment 1•15 years ago
|
||
Comment 2•15 years ago
|
||
We should get rid of JSCLASS_SHARE_ALL_PROPERTIES if we can. Ask m.d.t.js-engine if anyone is using it. /be
Assignee | ||
Comment 3•15 years ago
|
||
Asked.
Assignee | ||
Comment 4•15 years ago
|
||
The first time through the loop, CASE(JSOP_SETPROP) fills the property cache with an "adding" entry. The second time through, CASE(JSOP_SETPROP) mistakenly treats it as a non-adding entry and goes straight to NATIVE_SET without adding the property. As it happens, the assertion that catches the mistake is in the JIT, but even with the JIT disabled we would be in trouble. This has been broken for a while now, and no one has complained.
Assignee | ||
Comment 5•14 years ago
|
||
Assignee: general → jorendorff
Attachment #411549 -
Attachment is obsolete: true
Attachment #439184 -
Flags: review?(brendan)
Comment 6•14 years ago
|
||
Comment on attachment 439184 [details] [diff] [review] v2 - just remove JSCLASS_SHARE_ALL_PROPERTIES >-#define JSCLASS_SHARE_ALL_PROPERTIES (1<<4) /* all properties are SHARED */ Leave a placeholder comment for (1<<4) here? r=me otherwise -- thanks. I once received champagne for adding JSPROP_SHARED, saving someone using proto getters and setters from garbage entrainment via the slot. But this jsclass knob was never used by that bug reporter (whose name I forget -- someone in Europe). Deadwood from the start. /be
Attachment #439184 -
Flags: review?(brendan) → review+
Assignee | ||
Comment 7•14 years ago
|
||
For reference, the newsgroup thread is here: http://groups.google.com/group/mozilla.dev.tech.js-engine/browse_thread/thread/b5b6987f408210a1/3f7a360003c95808?lnk=gst&q=ash+berlin&pli=1
Assignee | ||
Comment 8•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/711737bd3305 http://hg.mozilla.org/tracemonkey/rev/777ada4eb95d
Whiteboard: fixed-in-tracemonkey
Comment 9•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/711737bd3305
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Comment 10•12 years ago
|
||
Could you mention the removal of JSCLASS_SHARE_ALL_PROPERTIES in the documentation, it's a bit confusing now: https://developer.mozilla.org/en/SpiderMonkey/JSAPI_Reference/JSClass.flags
You need to log in
before you can comment on or make changes to this bug.
Description
•