Closed Bug 844470 Opened 10 years ago Closed 10 years ago

BaselineCompiler: Assertion failure: TrackPropertyTypes(cx, obj, id), at ../jsinferinlines.h:621

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: jandem)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [js:t][jsbugmon:update])

Attachments

(1 file)

The following testcase asserts on baseline compiler branch revision b7e4d01b541e (run with --ion-eager):


var s='';
for (i=0; (i) < 1<<16; i++)
  s += 'x' + i + '=' + i + ';\n';
eval(s);
Attached patch PatchSplinter Review
Calling TypeObject::getProperty can mark the TypeObject as having unknown properties.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #717893 - Flags: review?(bhackett1024)
Attachment #717893 - Flags: review?(bhackett1024) → review+
Whiteboard: [jsbugmon:update] → [js:t][jsbugmon:update]
https://hg.mozilla.org/projects/ionmonkey/rev/016d86f109c7
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.