Last Comment Bug 683999 - "Assertion failure: hasSingletonType()" in JSObject::splicePrototype (jsinfer.cpp)
: "Assertion failure: hasSingletonType()" in JSObject::splicePrototype (jsinfer...
Status: RESOLVED FIXED
fixed-in-jaegermonkey
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: 326633 594645 infer-regress 670185
  Show dependency treegraph
 
Reported: 2011-09-01 12:20 PDT by Jesse Ruderman
Modified: 2013-03-11 11:26 PDT (History)
2 users (show)
choller: in‑testsuite-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (asserts fatally when loaded) (320 bytes, text/html)
2011-09-01 12:20 PDT, Jesse Ruderman
no flags Details
stack trace (7.26 KB, text/plain)
2011-09-01 12:24 PDT, Jesse Ruderman
no flags Details
patch (1006 bytes, patch)
2011-09-06 11:15 PDT, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2011-09-01 12:20:54 PDT
Created attachment 557602 [details]
testcase (asserts fatally when loaded)

Assertion failure: hasSingletonType(), at js/src/jsinfer.cpp:5071
Comment 1 Jesse Ruderman 2011-09-01 12:24:07 PDT
Created attachment 557604 [details]
stack trace
Comment 2 Brian Hackett (:bhackett) 2011-09-06 11:15:24 PDT
Created attachment 558530 [details] [diff] [review]
patch

TI adds a JS_SplicePrototype API function which allows XPConnect to rearrange the prototype chain while preserving precise types for global properties etc.  This is only intended to be used for objects with singleton types (where we can do this rearranging), but because of mutable __proto__ other objects may get passed in instead.  Fix makes this function robust for such objects.
Comment 3 Brian Hackett (:bhackett) 2011-09-06 22:55:44 PDT
http://hg.mozilla.org/projects/jaegermonkey/rev/f3dd7cf2d0b3
Comment 4 Brian Hackett (:bhackett) 2011-09-22 14:17:16 PDT
https://hg.mozilla.org/mozilla-central/rev/9ca3d16d575c
Comment 5 Christian Holler (:decoder) 2013-03-11 11:26:01 PDT
Filter on qa-project-auto-change:

Bug in removed tracer code, setting in-testsuite- flag.

Note You need to log in before you can comment on or make changes to this bug.