607502 - JM: "Assertion failure: isShape()" with Object.freeze(this)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js -m

function q() { ++i; }
var i = 0;
Object.freeze(this);
q();
q();

Assertion failure: isShape(), at js/src/jspropertycache.h:112

Comment 1

[Jeff Walden [:Waldo]]

It's trying to use some sort of genericized name-increment code that getgnames, does math, and setgnames, and the two ops naturally don't interact well with the single slot-looking property cache entry created by the interpreter for incops.  I couldn't quite follow the code, and its bewildering variety of similar names, well enough to say any more with much confidence in my reading of it.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Smarter disabling of property cache usage, like for the other ICs.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/3d63107fc788

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3d63107fc788

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929