Last Comment Bug 683999 - "Assertion failure: hasSingletonType()" in JSObject::splicePrototype (jsinfer.cpp)
: "Assertion failure: hasSingletonType()" in JSObject::splicePrototype (jsinfer...
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 326633 594645 infer-regress 670185
  Show dependency treegraph
Reported: 2011-09-01 12:20 PDT by Jesse Ruderman
Modified: 2013-03-11 11:26 PDT (History)
2 users (show)
choller: in‑testsuite-
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (asserts fatally when loaded) (320 bytes, text/html)
2011-09-01 12:20 PDT, Jesse Ruderman
no flags Details
stack trace (7.26 KB, text/plain)
2011-09-01 12:24 PDT, Jesse Ruderman
no flags Details
patch (1006 bytes, patch)
2011-09-06 11:15 PDT, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Splinter Review

Description User image Jesse Ruderman 2011-09-01 12:20:54 PDT
Created attachment 557602 [details]
testcase (asserts fatally when loaded)

Assertion failure: hasSingletonType(), at js/src/jsinfer.cpp:5071
Comment 1 User image Jesse Ruderman 2011-09-01 12:24:07 PDT
Created attachment 557604 [details]
stack trace
Comment 2 User image Brian Hackett (:bhackett) 2011-09-06 11:15:24 PDT
Created attachment 558530 [details] [diff] [review]

TI adds a JS_SplicePrototype API function which allows XPConnect to rearrange the prototype chain while preserving precise types for global properties etc.  This is only intended to be used for objects with singleton types (where we can do this rearranging), but because of mutable __proto__ other objects may get passed in instead.  Fix makes this function robust for such objects.
Comment 3 User image Brian Hackett (:bhackett) 2011-09-06 22:55:44 PDT
Comment 4 User image Brian Hackett (:bhackett) 2011-09-22 14:17:16 PDT
Comment 5 User image Christian Holler (:decoder) 2013-03-11 11:26:01 PDT
Filter on qa-project-auto-change:

Bug in removed tracer code, setting in-testsuite- flag.

Note You need to log in before you can comment on or make changes to this bug.