Closed Bug 617558 Opened 10 years ago Closed 10 years ago
Inference: Assertion failure: !object->is Dense Array
./js -m js> .__proto__.foo = true; eval(""); Assertion failure: !object->isDenseArray, at ../jsinfer.cpp:2107
This is a bug in the inference itself. Type objects can get marked as having all properties unknown when they've had dynamic string property assignments through SETELEM, had __proto__ assigned to or have a prototype with unknown properties. This shouldn't happen for type objects representing dense and/or packed arrays, but could if Array.prototype itself was marked with unknown properties. This also fixes things so that assignments in the interpreter don't poison updated type objects with unknown properties (oops). http://hg.mozilla.org/projects/jaegermonkey/rev/0b73d74d343d
Assignee: general → bhackett1024
10 years ago
You need to log in before you can comment on or make changes to this bug.