617558 - TypeInference: Assertion failure: !object->isDenseArray

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

./js -m
js> [].__proto__.foo = true; eval("[]");
Assertion failure: !object->isDenseArray, at ../jsinfer.cpp:2107

Comment 1

[Brian Hackett [Laid off!]]

Attachment: fix

This is a bug in the inference itself.  Type objects can get marked as having all properties unknown when they've had dynamic string property assignments through SETELEM, had __proto__ assigned to or have a prototype with unknown properties.  This shouldn't happen for type objects representing dense and/or packed arrays, but could if Array.prototype itself was marked with unknown properties.  This also fixes things so that assignments in the interpreter don't poison updated type objects with unknown properties (oops).

http://hg.mozilla.org/projects/jaegermonkey/rev/0b73d74d343d