IonMonkey: Assertion failure: entry->prop == shape, at js/src/jsinterp.cpp:1275

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: jandem, Assigned: dvander)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The testcase below is reduced from tests/basic/splice-check-steps.js

$ ./js --ion -n test.js
Assertion failure: entry->prop == shape, at js/src/jsinterp.cpp:1275

Looks like there's a problem with the two NAME ops in the "note" function.
--
function f(obj) {
    var order = [];
    function note() {
        order;
        obj;
    }
    return Proxy.create({get: note});
}
proxy = f({});
for (var i=0; i<90; i++)
    proxy.foo;
proxy = f({});
for (var i=0; i<90; i++)
    proxy.foo;
(Assignee)

Comment 1

5 years ago
Created attachment 593215 [details] [diff] [review]
fix
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #593215 - Flags: review?(bhackett1024)
Attachment #593215 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 2

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/4e487dfde168
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.