Closed Bug 686179 Opened 8 years ago Closed 8 years ago

TI: Assertion failure: [infer failure] Missing type in object [0x7f6e8b304340] arguments: null, at jsinfer.cpp:341

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: fixed-in-jaegermonkey)

The following test asserts on jaegermonkey branch revision b31b25125429 (options -m -n -a):


(function () {
  assertEquals = function assertEquals(expected, found, name_opt) {  };
  assertTrue = function assertTrue(value, name_opt) {  };
})();
function f0() {}
function f1(x) {}
function test(f) {
  assertTrue(null === (assertEquals).arguments);
}
test(f0);
test(f1);
Overly strict assert when checking the consistency of type information with values read at property accesses in the VM.  Property types are only required to reflect the values of normal data/method properties and dense array elements, but this was asserting that properties with getter hooks also had correct type information.  There used to be code that kept the getter hook property types up to date, but this property is not guaranteed, nothing downstream depended on this and it was wasted work, so removed in the getter PIC patch.

http://hg.mozilla.org/projects/jaegermonkey/rev/820f11a3fdb1
Whiteboard: fixed-in-jaegermonkey
https://hg.mozilla.org/mozilla-central/rev/c943bbf9dac4
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.