Closed Bug 673469 Opened 9 years ago Closed 9 years ago

TI: "Assertion failure: [infer failure] Missing type in object <0x2d0d040>:new (index): #5:3,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

var a = Boolean();
false.__proto__;
var c = ({}).__proto__;
var d = {};
gc()
c[0] = d;
for (var x in a) {
  a[x];
}

asserts js debug shell on JM changeset 85b77c0781b6 with -a and -n at Assertion failure: [infer failure] Missing type in object <0x2d0d040>:new (index): #5:3,
We used to generate type constraints propagating types from prototypes into their instance objects, and keep these across GCs.  Bug 669969 removed this, and as a consequence requires these constraints to be regenerated as needed after each GC (only for properties which analyzed scripts are accessing, though).  The bit which indicates this propagation has been performed wasn't being reset on GC, so this didn't actually happen.

http://hg.mozilla.org/projects/jaegermonkey/rev/4fbb36c1c9a3
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug673469.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.