Closed Bug 700300 Opened 12 years ago Closed 12 years ago

[ObjShrink]: Assertion failure: pobj == found, at jsinterp.cpp:1456

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: decoder, Assigned: bhackett1024)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

patch
5.71 KB, patch
luke
: review+
Details | Diff | Splinter Review 
The following testcase asserts on jaegermonkey branch revision 1210706b4576 (run with -m -n), tested on 64 bit:


for (let j = 0; j < (2); ++(__lookupSetter__)) {
  function g() { j; }
}
Attached patch patch — — Splinter Review 
Erk, the DELEGATE bit wasn't ever being set when marking objects as parents of one another, as required by the teleporting optimization.  FWIW, I'd like to remove the teleporting optimization pretty soon --- it has a higher cost now that it requires new shapes to be created for every delegate, and doesn't really buy much given TI.

https://hg.mozilla.org/projects/jaegermonkey/rev/33962bb21403
Assignee: general → bhackett1024
Attachment #573046 - Flags: review?(luke)
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Attachment #573046 - Flags: review?(luke) → review+
No longer depends on: 714614
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug700300.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.