Closed
Bug 667108
Opened 13 years ago
Closed 13 years ago
TM: Assertion failure: pobj->getSlot(shape->slot).toObject() == shape->methodObject(), at jsobj.cpp:5592
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 561359
People
(Reporter: decoder, Assigned: jorendorff)
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
2.12 KB,
text/plain
|
Details |
The following testcase asserts on TM revision e77af15dc4d4 (run with options -j -m):
order = Number.POSITIVE_INFINITY;
var i = 0;
for (let methods = 0; methods < 4; ++methods) {
obj = {m: function () { return ".getSeconds()".x; }};
obj.watch("m", function (id, oldval, newval) { methods[i] = oldval; });
obj.m = 0;
}
Comment 1•13 years ago
|
||
Not sure if this is related to an older bug 561359..
Comment 2•13 years ago
|
||
For this slightly different test case:
order = Number.POSITIVE_INFINITY;
var i = 0;
for (let methods = 0; methods < 4; ++methods) {
obj = {m: function () { return ".getSeconds()".x; }};
obj.watch("m", function (id, oldval, newval) { methods[i] = 0 });
dumpObject(obj);
obj.m = 0;
}
I get this output:
object 00B0D040
class 01331540 Object
flags: method_barrier own_shape
proto <Object at 00B02060>
parent <global object at 00B02010>
properties:
((Shape *) 00B09D58) enumerate method=00B0A0B0 getterOp=00B0A0B0 setterOp=js_watch_set "m": slot 0 = <unnamed function (c:/sources/scratch/de.js:4) at 00B0A0B0 (JSFunction at 00B0A0B0)>
object 00B0D088
class 01331540 Object
flags: method_barrier own_shape
proto <Object at 00B02060>
parent <global object at 00B02010>
properties:
((Shape *) 00B09D58) enumerate method=00B0A0B0 getterOp=00B0A0B0 setterOp=js_watch_set "m": slot 0 = <unnamed function (c:/sources/scratch/de.js:4) at 00B0C1C8 (JSFunction at 00B0A0B0)>
Assertion failure: pobj->getSlot(shape->slot).toObject() == shape->methodObject(), at c:/sources/tracemonkey/js/src/jsobj.cpp:5592
On the second iteration of the loop, |obj| gets what appears to be a new clone of the same function in its slot. If I move the |dumpObject| up one line, there is no assert. Must be some twitchy interaction with the read barrier.
Comment 3•13 years ago
|
||
Decoder: With your testcase in the original post I get Assertion failure: shape.methodObject() == prev.toObject(), at /home/alex/src/js/src/jsscope.cpp:1195
Stack trace next...
Comment 4•13 years ago
|
||
Assignee | ||
Comment 6•13 years ago
|
||
I think this is a duplicate of 561359. It apparently has nothing to do with watchpoints. This test is equivalent except for the watch() call, and it asserts the same way:
order = Number.POSITIVE_INFINITY;
var i = 0;
for (let methods = 0; methods < 4; ++methods) {
obj = {m: function () { return ".getSeconds()".x; }};
f = function (id, oldval, newval) { methods[i] = oldval; };
obj.m = 0;
}
Assignee | ||
Comment 7•13 years ago
|
||
Confirmed. This is fixed.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Reporter | ||
Comment 8•12 years ago
|
||
A testcase for this bug was already added in the original bug (bug 561359).
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•