TI: Crash [@ js::mjit::Compiler::arrayPrototypeHasIndexedProperty] or "Assertion failure: !unknownProperties(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, crash, testcase})

Trunk
x86
Linux
assertion, crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 531585 [details]
stacks

o14 = [undefined].__proto__
function f18() {
  try {
    [] = o[p]
  } catch (e) {}
}
for (var i;; i++) {
  ({
    x: function() {
      return eval("o14")
    }
  }.x().__proto__ = null);
  f18()
}

crashes js opt shell on JM changeset fd1abc43d698 with -m and -n at js::mjit::Compiler::arrayPrototypeHasIndexedProperty and asserts js debug shell at Assertion failure: !unknownProperties(),
I get the same assertion (Assertion failure: !unknownProperties(), at ../jsinferinlines.h:1215) with the following test (options -m -n -a) on 64 bit:


function toPrinted(value) digits[0xf];
function reportCompare(expected, actual, description) + ++toPrinted() + "'";
var summary = 'Dense Arrays and holes';
var actual = '';
Array.prototype[true] = 'bar';
expect = 'foo,bar,baz';
reportCompare(expect, actual, summary);
Needed to test Array.prototype for unknown properties before seeing if it has indexed properties.  This is an older issue exposed by the recent change to how object flags are tested for (in the push/pop patch).  For type sets which don't contain objects at all, we shouldn't be emitting paths based on certain object flags like dense/packed arrays.

http://hg.mozilla.org/projects/jaegermonkey/rev/20d04cc7ca8a
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Crash Signature: [@ js::mjit::Compiler::arrayPrototypeHasIndexedProperty]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug656252.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.