Closed Bug 595921 Opened 13 years ago Closed 13 years ago

JM: "Assertion failure: newShape != initialShape,"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: gkw, Assigned: bhackett1024)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

fix
1.98 KB, patch
dmandelin
: review+
Details | Diff | Splinter Review 
x = <x/>
function f(aaa) {
    aaa.e = x
}
for each(let c in [x, x, x]) {
    f(c)
}

asserts js debug shell on TM changeset f5e128da7b5f with -m at Assertion failure: newShape != initialShape,
blocking2.0: --- → ?
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   53114:9a8b156c7396
user:        Brian Hackett
date:        Sat Sep 04 20:12:56 2010 -0700
summary:     PIC for addprop, bug 561506. r=dmandelin
Blocks: 561506
Attached patch fix — — Splinter Review 
This disables the setprop pic for objects with custom setProperty/ops.setProperty/ops.lookupProperty hooks, and the addprop pic for objects with custom addProperty/ops.defineProperty hooks.  These won't catch js_ObjectClass or js_CallClass.
Assignee: general → bhackett1024
Attachment #475140 - Flags: review?(dmandelin)
Attachment #475140 - Flags: review?(dmandelin) → review+
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/708c6d2e33ee
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
blocking2.0: ? → betaN+
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug595921.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.