Closed Bug 656252 Opened 9 years ago Closed 9 years ago

TI: Crash [@ js::mjit::Compiler::arrayPrototypeHasIndexedProperty] or "Assertion failure: !unknownProperties(),"

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, testcase)

Crash Data

Attachments

(1 file)

Attached file stacks
o14 = [undefined].__proto__
function f18() {
  try {
    [] = o[p]
  } catch (e) {}
}
for (var i;; i++) {
  ({
    x: function() {
      return eval("o14")
    }
  }.x().__proto__ = null);
  f18()
}

crashes js opt shell on JM changeset fd1abc43d698 with -m and -n at js::mjit::Compiler::arrayPrototypeHasIndexedProperty and asserts js debug shell at Assertion failure: !unknownProperties(),
I get the same assertion (Assertion failure: !unknownProperties(), at ../jsinferinlines.h:1215) with the following test (options -m -n -a) on 64 bit:


function toPrinted(value) digits[0xf];
function reportCompare(expected, actual, description) + ++toPrinted() + "'";
var summary = 'Dense Arrays and holes';
var actual = '';
Array.prototype[true] = 'bar';
expect = 'foo,bar,baz';
reportCompare(expect, actual, summary);
Needed to test Array.prototype for unknown properties before seeing if it has indexed properties.  This is an older issue exposed by the recent change to how object flags are tested for (in the push/pop patch).  For type sets which don't contain objects at all, we shouldn't be emitting paths based on certain object flags like dense/packed arrays.

http://hg.mozilla.org/projects/jaegermonkey/rev/20d04cc7ca8a
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Crash Signature: [@ js::mjit::Compiler::arrayPrototypeHasIndexedProperty]
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug656252.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.