Closed Bug 700300 Opened 8 years ago Closed 8 years ago

[ObjShrink]: Assertion failure: pobj == found, at jsinterp.cpp:1456

Categories

(Core :: JavaScript Engine, defect, critical)

Other Branch
x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: bhackett)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The following testcase asserts on jaegermonkey branch revision 1210706b4576 (run with -m -n), tested on 64 bit:


for (let j = 0; j < (2); ++(__lookupSetter__)) {
  function g() { j; }
}
Attached patch patchSplinter Review
Erk, the DELEGATE bit wasn't ever being set when marking objects as parents of one another, as required by the teleporting optimization.  FWIW, I'd like to remove the teleporting optimization pretty soon --- it has a higher cost now that it requires new shapes to be created for every delegate, and doesn't really buy much given TI.

https://hg.mozilla.org/projects/jaegermonkey/rev/33962bb21403
Assignee: general → bhackett1024
Attachment #573046 - Flags: review?(luke)
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Attachment #573046 - Flags: review?(luke) → review+
Depends on: 709929
Depends on: 714614
No longer depends on: 714614
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug700300.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.