Closed Bug 647463 Opened 9 years ago Closed 9 years ago

TI: "Assertion failure: currentCapacity == initLength,"

Categories

(Core :: JavaScript Engine, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file stack
try {
    eval("\
        [0].sort()\
    ")
} catch (e) {}

asserts js debug shell on JM changeset c340841f0465 at Assertion failure: currentCapacity == initLength
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   64251:baccdc943514
user:        Brian Hackett
date:        Fri Apr 01 17:26:34 2011 -0700
summary:     [INFER] More fixes for stock JM behavior, bug 647048.
Blocks: 647048
OS: Linux → All
Hardware: x86 → All
Singleton arrays were not being backfilled with holes between their extent and capacity (this is a new assertion for ensuring perf when running without -n).  Though I think this code was broken anyways, as a GC triggered while filling in the singleton array could see uninitialized values (only affects JM branch, not TM branch).  This fix changes singleton array initialization to look like JSON array initialization, using defineProperty.

http://hg.mozilla.org/projects/jaegermonkey/rev/1b6abbd8e1ef
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug647463.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.