Closed Bug 665289 Opened 9 years ago Closed 8 years ago

TI: "Assertion failure: !unknownProperties(),"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file stack
delete this.Function;
a = evalcx("lazy");
a["Object"] = this;
if (typeof a.isPrototypeOf == "") {}

asserts js debug shell on JM changeset 9ff00d53b5a5 with -n at Assertion failure: !unknownProperties(), when the testcase is passed in as a CLI argument.

This was found using a combination of jsfunfuzz and jandem's method fuzzer.
Missed a case where we could redundantly mark a type object as having unknown properties.

http://hg.mozilla.org/projects/jaegermonkey/rev/ab061e5730cb
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug665289.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.