[ObjShrink]: Assertion failure: pobj == found, at jsinterp.cpp:1456

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following testcase asserts on jaegermonkey branch revision 1210706b4576 (run with -m -n), tested on 64 bit:


for (let j = 0; j < (2); ++(__lookupSetter__)) {
  function g() { j; }
}
(Assignee)

Comment 1

6 years ago
Created attachment 573046 [details] [diff] [review]
patch

Erk, the DELEGATE bit wasn't ever being set when marking objects as parents of one another, as required by the teleporting optimization.  FWIW, I'd like to remove the teleporting optimization pretty soon --- it has a higher cost now that it requires new shapes to be created for every delegate, and doesn't really buy much given TI.

https://hg.mozilla.org/projects/jaegermonkey/rev/33962bb21403
Assignee: general → bhackett1024
Attachment #573046 - Flags: review?(luke)
(Assignee)

Updated

6 years ago
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Updated

6 years ago
Attachment #573046 - Flags: review?(luke) → review+
Depends on: 709929
Depends on: 714614

Updated

5 years ago
No longer depends on: 714614
(Reporter)

Comment 2

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug700300.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.