Last Comment Bug 656252 - TI: Crash [@ js::mjit::Compiler::arrayPrototypeHasIndexedProperty] or "Assertion failure: !unknownProperties(),"
: TI: Crash [@ js::mjit::Compiler::arrayPrototypeHasIndexedProperty] or "Assert...
: assertion, crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress 630996
  Show dependency treegraph
Reported: 2011-05-11 04:48 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:18 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stacks (5.13 KB, text/plain)
2011-05-11 04:48 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description User image Gary Kwong [:gkw] [:nth10sd] 2011-05-11 04:48:59 PDT
Created attachment 531585 [details]

o14 = [undefined].__proto__
function f18() {
  try {
    [] = o[p]
  } catch (e) {}
for (var i;; i++) {
    x: function() {
      return eval("o14")
  }.x().__proto__ = null);

crashes js opt shell on JM changeset fd1abc43d698 with -m and -n at js::mjit::Compiler::arrayPrototypeHasIndexedProperty and asserts js debug shell at Assertion failure: !unknownProperties(),
Comment 1 User image Christian Holler (:decoder) 2011-05-11 04:54:03 PDT
I get the same assertion (Assertion failure: !unknownProperties(), at ../jsinferinlines.h:1215) with the following test (options -m -n -a) on 64 bit:

function toPrinted(value) digits[0xf];
function reportCompare(expected, actual, description) + ++toPrinted() + "'";
var summary = 'Dense Arrays and holes';
var actual = '';
Array.prototype[true] = 'bar';
expect = 'foo,bar,baz';
reportCompare(expect, actual, summary);
Comment 2 User image Brian Hackett (:bhackett) 2011-05-11 10:43:36 PDT
Needed to test Array.prototype for unknown properties before seeing if it has indexed properties.  This is an older issue exposed by the recent change to how object flags are tested for (in the push/pop patch).  For type sets which don't contain objects at all, we shouldn't be emitting paths based on certain object flags like dense/packed arrays.
Comment 3 User image Christian Holler (:decoder) 2013-01-14 08:18:04 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug656252.js.

Note You need to log in before you can comment on or make changes to this bug.