Assertion 'entry_index != start_entry_index' failed in ecma_property_hashmap_find

[renatahodovan]

Jerry version:

Checked revision: 7b59c80
Build: debug.linux

OS:

Ubuntu 16.04, x86_64

Test case:

function createHashTable() {
    var o = new Array()
    var elements = new Array()
    o.elementHash = function (i) {
        return Math.abs (i) & 31
    }
    o.add = function (i) {
        var elementIndex = this.elementHash (i)
        if(elements[elementIndex] !== undefined) {
            for(var j = elementIndex; j < elementIndex + 4 && j < 32; ++j) {
                delete this["h" + elements[j]]
            }
        }
        elements[elementIndex] = i
        this["h" + i] = i
    }
    return o
}
function useAsHashTable() {
    for(var $;;) {
        for(var j;; j = (j + 1) | $)
           o.add (j)
    }
}
var o = createHashTable()
useAsHashTable()

Backtrace:

ICE: Assertion 'entry_index != start_entry_index' failed at jerryscript/jerry-core/ecma/base/ecma-property-hashmap.c(ecma_property_hashmap_find):529.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted
bt
#0  0x000000000046daba in syscall_2 () at jerryscript/jerry-libc/target/posix/jerry-asm.S:59
#1  0x0000000000402760 in raise (sig=6) at jerryscript/jerry-libc/target/posix/jerry-libc-target.c:91
#2  0x0000000000402732 in abort () at jerryscript/jerry-libc/target/posix/jerry-libc-target.c:77
#3  0x00000000004113c6 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/targets/default/jerry-port-default-fatal.c:53
#4  0x000000000042ce6f in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:61
#5  0x000000000042cec1 in jerry_assert_fail (assertion=0x470e78 "entry_index != start_entry_index", file=0x470dd0 "jerryscript/jerry-core/ecma/base/ecma-property-hashmap.c", function=0x487630 <__func__.3594.lto_priv.114> "ecma_property_hashmap_find", line=529) at jerryscript/jerry-core/jrt/jrt-fatals.c:85
#6  0x000000000041224a in ecma_property_hashmap_find (hashmap_p=0x691d48 <jerry_global_heap+2896>, name_p=0x691c08 <jerry_global_heap+2576>, property_real_name_cp=0x7fffffffc22e) at jerryscript/jerry-core/ecma/base/ecma-property-hashmap.c:529
#7  0x0000000000463b91 in ecma_find_named_property (obj_p=0x691340 <jerry_global_heap+328>, name_p=0x691c08 <jerry_global_heap+2576>) at jerryscript/jerry-core/ecma/base/ecma-helpers.c:683
#8  0x0000000000435f8a in ecma_op_object_put (object_p=0x691340 <jerry_global_heap+328>, property_name_p=0x691c08 <jerry_global_heap+2576>, value=3120, is_throw=false) at jerryscript/jerry-core/ecma/operations/ecma-objects.c:774
#9  0x000000000041d77b in vm_op_set_value.lto_priv.143 (object=331, property=2578, value=3120, is_strict=false) at jerryscript/jerry-core/vm/vm.c:166
#10 0x000000000041ac75 in vm_loop.lto_priv.139 (frame_ctx_p=0x7fffffffc770) at jerryscript/jerry-core/vm/vm.c:2377
#11 0x00000000004155ed in vm_execute (frame_ctx_p=0x7fffffffc770, arg_p=0x7fffffffc9cc, arg_list_len=1) at jerryscript/jerry-core/vm/vm.c:2586
#12 0x0000000000415879 in vm_run (bytecode_header_p=0x691798 <jerry_global_heap+1440>, this_binding_value=331, lex_env_p=0x691300 <jerry_global_heap+264>, is_eval_code=false, arg_list_p=0x7fffffffc9cc, arg_list_len=1) at jerryscript/jerry-core/vm/vm.c:2664
#13 0x0000000000438719 in ecma_op_function_call (func_obj_p=0x6913c8 <jerry_global_heap+464>, this_arg_value=331, arguments_list_p=0x7fffffffc9cc, arguments_list_len=1) at jerryscript/jerry-core/ecma/operations/ecma-function-object.c:524
#14 0x000000000041db76 in opfunc_call.lto_priv.138 (frame_ctx_p=0x7fffffffca10) at jerryscript/jerry-core/vm/vm.c:385
#15 0x0000000000415614 in vm_execute (frame_ctx_p=0x7fffffffca10, arg_p=0x7fffffffcc54, arg_list_len=2) at jerryscript/jerry-core/vm/vm.c:2595
#16 0x0000000000415879 in vm_run (bytecode_header_p=0x6918f0 <jerry_global_heap+1784>, this_binding_value=27, lex_env_p=0x691220 <jerry_global_heap+40>, is_eval_code=false, arg_list_p=0x7fffffffcc54, arg_list_len=2) at jerryscript/jerry-core/vm/vm.c:2664
#17 0x0000000000438719 in ecma_op_function_call (func_obj_p=0x6912d0 <jerry_global_heap+216>, this_arg_value=72, arguments_list_p=0x7fffffffcc54, arguments_list_len=2) at jerryscript/jerry-core/ecma/operations/ecma-function-object.c:524
#18 0x000000000041db76 in opfunc_call.lto_priv.138 (frame_ctx_p=0x7fffffffcca0) at jerryscript/jerry-core/vm/vm.c:385
#19 0x0000000000415614 in vm_execute (frame_ctx_p=0x7fffffffcca0, arg_p=0x0, arg_list_len=0) at jerryscript/jerry-core/vm/vm.c:2595
#20 0x0000000000415879 in vm_run (bytecode_header_p=0x691ab0 <jerry_global_heap+2232>, this_binding_value=27, lex_env_p=0x691220 <jerry_global_heap+40>, is_eval_code=false, arg_list_p=0x0, arg_list_len=0) at jerryscript/jerry-core/vm/vm.c:2664
#21 0x000000000041d804 in vm_run_global (bytecode_p=0x691ab0 <jerry_global_heap+2232>) at jerryscript/jerry-core/vm/vm.c:211
#22 0x0000000000469b92 in jerry_run (func_val=139) at jerryscript/jerry-core/jerry.c:340
#23 0x000000000046d5b5 in main (argc=3, argv=0x7fffffffd2e8) at jerryscript/jerry-main/main-unix.c:711

[zherczeg]

A simpler test case:

var o = []

function add(i)
{
  delete o[i & 31];
  o[i] = i;
}

for (var i = 0; ; i++)  
{
  add(i)
}