If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

"Assertion failure: capacity >= fixed"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(2 attachments)

(Reporter)

Description

7 years ago
Created attachment 491446 [details]
stack trace

var a = [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1];
a.push(1);
a.splice(0);
a.d = "";

Assertion failure: capacity >= fixed, at js/src/jsobjinlines.h:677

The first bad revision is:
changeset:   bc000c1509ac
user:        Brian Hackett
date:        Mon Nov 15 17:21:58 2010 -0800
summary:     Fix fixed slots invariant for slow arrays, bug 610592. r=brendan
(Assignee)

Comment 1

7 years ago
Created attachment 491449 [details] [diff] [review]
patch

Thanks!  We would allow the number of slots on an object to shrink below the number of fixed slots, which confused revertToFixedSlots.
Assignee: general → bhackett1024
Attachment #491449 - Flags: review?(brendan)
Attachment #491449 - Flags: review?(brendan) → review+
(Assignee)

Comment 2

7 years ago
http://hg.mozilla.org/tracemonkey/rev/8a888bf6d83c
Whiteboard: fixed-in-tracemonkey

Comment 3

7 years ago
http://hg.mozilla.org/mozilla-central/rev/8a888bf6d83c
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug613122.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.