TM: "Assertion failure: IsDenseArrayId(cx, obj, (jsid) prop), at ../jsarray.cpp"

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
10 years ago
7 years ago

People

(Reporter: gkw, Assigned: jorendorff)

Tracking

(Blocks 1 bug, {assertion, regression, testcase})

Trunk
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.2 +
in-testsuite +

Firefox Tracking Flags

(status1.9.2 final-fixed)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(function() {
  for each(z in [0, 0, 0, 0]) { ({
      __parent__: []
    } = [])
  }
})()


asserts js debug shell on TM tip with -j at Assertion failure: IsDenseArrayId(cx, obj, (jsid) prop), at ../jsarray.cpp:745

autoBisect shows this is probably related to bug 507683:

The first bad revision is:
changeset:   31824:8ca247a7d4ba
user:        Jason Orendorff
date:        Tue Aug 25 15:02:58 2009 -0700
summary:     Bug 507683 part 2 - Avoid lookup on trace when calling a native getter with no slot. r=gal.
Nominating for 1.9.2 since the potentially related bug has landed on 1.9.2, deferring to others about whether this issue should be blocking or not.
Flags: wanted1.9.2?
Flags: blocking1.9.2?
Assignee: general → jorendorff
Flags: blocking1.9.2? → blocking1.9.2+
Posted patch v1Splinter Review
blah
Attachment #415946 - Flags: review?(jwalden+bmo)
Comment on attachment 415946 [details] [diff] [review]
v1

r=bzbarsky
Attachment #415946 - Flags: review?(jwalden+bmo) → review+
http://hg.mozilla.org/tracemonkey/rev/f35155bb7064
Whiteboard: fixed-in-tracemonkey
Flags: wanted1.9.2?
http://hg.mozilla.org/mozilla-central/rev/f35155bb7064
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.