1018621 - Assertion failure: !val.isMagic(), at jit/BaselineIC.cpp:1168

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 323156681cef (run with --fuzzing-safe --ion-eager):


function strictSome(k) {
  "use strict";
  for (var i = 0; i < args.length; i++)
    assertEq(arguments[i], args[i], "wrong argument " + i);
}
args = [8, 6, 7, NaN, undefined, 0.3];
strictSome.call(NaN, 8, 6, 7, NaN, undefined, 0.3);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/87d402b80185
user:        Shu-yu Guo
date:        Tue May 06 19:20:47 2014 -0700
summary:     Bug 1005458 - Argument slot phis are always observable in non-strict scripts due to Function.arguments. (r=nbp)

This iteration took 451.418 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo from shu based on comment 2 :)

Comment 4

[Shu-yu Guo [:shu]]

Attachment: Fix strict mode arguments observability in Ion.

Oops, Function.arguments may not be observable in strict mode, but normal
arguments is.

Comment 5

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6aa30c2cc6da

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6aa30c2cc6da