645632 - TI: Assertion failure: !unknownProperties, at ../jsinferinlines.h:1164

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f(o) {
    o[{}] = 1;
    with(Object) {}
}
f(Object.prototype);
--
$ ./js -n -a test.js
Assertion failure: !unknownProperties, at ../jsinferinlines.h:1164

Comment 1

[Jesse Ruderman]

Due to skipped revisions, the first bad revision could be any of:
changeset:   63691:2a6ecf5af25c
user:        Brian Hackett <[e-mail]>
date:        Sat Mar 26 19:07:13 2011 -0700
summary:     [INFER] Inline scripted calls, bug 639099.

changeset:   63692:e2b96219a262
user:        Brian Hackett <[e-mail]>
date:        Sat Mar 26 19:56:49 2011 -0700
summary:     [INFER] Fix x64 build, revert accidental manifest.py changes, bug 639099.

Comment 2

[Brian Hackett [Laid off!]]

Unnecessarily trying to notify inline callers of new dynamic types in the callee, when the function has unknown properties and can't be inlined regardless.

http://hg.mozilla.org/projects/jaegermonkey/rev/6acd5754040b

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug645632.js.