Closed Bug 662044 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: obj->nativeContains(*shape), at jsinterp.cpp:4355

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

The following testcase asserts on TI revision a638ecbe6843 (run with -j -m -n -a), tested on 64 bit:


eval("var OBJ = new MyObject(true); OBJ.valueOf()") 
function MyObject( value ) {
  this.valueOf = new Function( "return this.value" );
}
eval("\
var VERSION = \"ECMA_1\";\
var DATE1 = new Date();\
var MYOB1 = new MyObject( DATE1 );\
function MyProtoValuelessObject() {}\
function Function() {\
  __proto__[MyProtoValuelessObject] = VERSION;\
}");
obj->rollbackProperties() (called when we invalidate the definite property information on an object while it is in the middle of being initialized) was not updating the shape number after fixing the last property of the object.

http://hg.mozilla.org/projects/jaegermonkey/rev/2ebc9b25756b
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 676763
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug662044.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.