647463 - TI: "Assertion failure: currentCapacity == initLength,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    eval("\
        [0].sort()\
    ")
} catch (e) {}

asserts js debug shell on JM changeset c340841f0465 at Assertion failure: currentCapacity == initLength

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   64251:baccdc943514
user:        Brian Hackett
date:        Fri Apr 01 17:26:34 2011 -0700
summary:     [INFER] More fixes for stock JM behavior, bug 647048.

Comment 2

[Brian Hackett [Laid off!]]

Singleton arrays were not being backfilled with holes between their extent and capacity (this is a new assertion for ensuring perf when running without -n).  Though I think this code was broken anyways, as a GC triggered while filling in the singleton array could see uninitialized values (only affects JM branch, not TM branch).  This fix changes singleton array initialization to look like JSON array initialization, using defineProperty.

http://hg.mozilla.org/projects/jaegermonkey/rev/1b6abbd8e1ef

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug647463.js.