Closed
Bug 686179
Opened 10 years ago
Closed 10 years ago
TI: Assertion failure: [infer failure] Missing type in object [0x7f6e8b304340] arguments: null, at jsinfer.cpp:341
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: fixed-in-jaegermonkey)
The following test asserts on jaegermonkey branch revision b31b25125429 (options -m -n -a): (function () { assertEquals = function assertEquals(expected, found, name_opt) { }; assertTrue = function assertTrue(value, name_opt) { }; })(); function f0() {} function f1(x) {} function test(f) { assertTrue(null === (assertEquals).arguments); } test(f0); test(f1);
Comment 1•10 years ago
|
||
Overly strict assert when checking the consistency of type information with values read at property accesses in the VM. Property types are only required to reflect the values of normal data/method properties and dense array elements, but this was asserting that properties with getter hooks also had correct type information. There used to be code that kept the getter hook property types up to date, but this property is not guaranteed, nothing downstream depended on this and it was wasted work, so removed in the getter PIC patch. http://hg.mozilla.org/projects/jaegermonkey/rev/820f11a3fdb1
Whiteboard: fixed-in-jaegermonkey
Comment 2•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/c943bbf9dac4
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 3•8 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•