Note: There are a few cases of duplicates in user autocompletion which are being worked on.

"Assertion failure: hasSingletonType()" in JSObject::splicePrototype (jsinfer.cpp)

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 3 bugs, {assertion, regression, testcase})

Trunk
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 557602 [details]
testcase (asserts fatally when loaded)

Assertion failure: hasSingletonType(), at js/src/jsinfer.cpp:5071
(Reporter)

Comment 1

6 years ago
Created attachment 557604 [details]
stack trace
Created attachment 558530 [details] [diff] [review]
patch

TI adds a JS_SplicePrototype API function which allows XPConnect to rearrange the prototype chain while preserving precise types for global properties etc.  This is only intended to be used for objects with singleton types (where we can do this rearranging), but because of mutable __proto__ other objects may get passed in instead.  Fix makes this function robust for such objects.
Attachment #558530 - Flags: review?(dvander)
http://hg.mozilla.org/projects/jaegermonkey/rev/f3dd7cf2d0b3
Whiteboard: fixed-in-jaegermonkey
Attachment #558530 - Flags: review?(dvander) → review+
https://hg.mozilla.org/mozilla-central/rev/9ca3d16d575c
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Filter on qa-project-auto-change:

Bug in removed tracer code, setting in-testsuite- flag.
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.