Last Comment Bug 683999 - "Assertion failure: hasSingletonType()" in JSObject::splicePrototype (jsinfer.cpp)
: "Assertion failure: hasSingletonType()" in JSObject::splicePrototype (jsinfer...
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
Depends on:
Blocks: 326633 594645 infer-regress 670185
  Show dependency treegraph
Reported: 2011-09-01 12:20 PDT by Jesse Ruderman
Modified: 2013-03-11 11:26 PDT (History)
2 users (show)
choller: in‑testsuite-
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (asserts fatally when loaded) (320 bytes, text/html)
2011-09-01 12:20 PDT, Jesse Ruderman
no flags Details
stack trace (7.26 KB, text/plain)
2011-09-01 12:24 PDT, Jesse Ruderman
no flags Details
patch (1006 bytes, patch)
2011-09-06 11:15 PDT, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Review

Description Jesse Ruderman 2011-09-01 12:20:54 PDT
Created attachment 557602 [details]
testcase (asserts fatally when loaded)

Assertion failure: hasSingletonType(), at js/src/jsinfer.cpp:5071
Comment 1 Jesse Ruderman 2011-09-01 12:24:07 PDT
Created attachment 557604 [details]
stack trace
Comment 2 Brian Hackett (:bhackett) 2011-09-06 11:15:24 PDT
Created attachment 558530 [details] [diff] [review]

TI adds a JS_SplicePrototype API function which allows XPConnect to rearrange the prototype chain while preserving precise types for global properties etc.  This is only intended to be used for objects with singleton types (where we can do this rearranging), but because of mutable __proto__ other objects may get passed in instead.  Fix makes this function robust for such objects.
Comment 3 Brian Hackett (:bhackett) 2011-09-06 22:55:44 PDT
Comment 4 Brian Hackett (:bhackett) 2011-09-22 14:17:16 PDT
Comment 5 Christian Holler (:decoder) 2013-03-11 11:26:01 PDT
Filter on qa-project-auto-change:

Bug in removed tracer code, setting in-testsuite- flag.

Note You need to log in before you can comment on or make changes to this bug.