Closed Bug 527805 Opened 15 years ago Closed 14 years ago

"Assertion failure: scope->object == obj2, at ../jstracer.cpp:11212" with JIT and JSCLASS_SHARE_ALL_PROPERTIES

Categories

(Core :: JavaScript Engine, defect)

Other Branch
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jorendorff, Assigned: jorendorff)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file, 1 obsolete file)

See attached jsapi-test. This is a JSAPI-only bug if (as mxr claims) JSCLASS_SHARE_ALL_PROPERTIES is unused in Mozilla.
Attached patch WIP 1 - just the test (obsolete) — Splinter Review
We should get rid of JSCLASS_SHARE_ALL_PROPERTIES if we can. Ask m.d.t.js-engine if anyone is using it.

/be
Asked.
The first time through the loop, CASE(JSOP_SETPROP) fills the property cache with an "adding" entry.

The second time through, CASE(JSOP_SETPROP) mistakenly treats it as a non-adding entry and goes straight to NATIVE_SET without adding the property.

As it happens, the assertion that catches the mistake is in the JIT, but even with the JIT disabled we would be in trouble. This has been broken for a while now, and no one has complained.
Assignee: general → jorendorff
Attachment #411549 - Attachment is obsolete: true
Attachment #439184 - Flags: review?(brendan)
Comment on attachment 439184 [details] [diff] [review]
v2 - just remove JSCLASS_SHARE_ALL_PROPERTIES

>-#define JSCLASS_SHARE_ALL_PROPERTIES    (1<<4)  /* all properties are SHARED */

Leave a placeholder comment for (1<<4) here?

r=me otherwise -- thanks. I once received champagne for adding JSPROP_SHARED, saving someone using proto getters and setters from garbage entrainment via the slot. But this jsclass knob was never used by that bug reporter (whose name I forget -- someone in Europe). Deadwood from the start.

/be
Attachment #439184 - Flags: review?(brendan) → review+
http://hg.mozilla.org/mozilla-central/rev/711737bd3305
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Could you mention the removal of JSCLASS_SHARE_ALL_PROPERTIES in the documentation, it's a bit confusing now:

https://developer.mozilla.org/en/SpiderMonkey/JSAPI_Reference/JSClass.flags
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: