633752 - TM: Assertion failure: (frameobj == NULL) == (*mTypeMap == JSVAL_TYPE_NULL), at ../jstracer.cpp:3174

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

---
function f(o) {
    var p = "arguments";
    for(var i=0; i<10; i++) {
        f[p];
    }
}
f({});
f({});
f({});
f({});
---
This asserts with -j -m -a:

Assertion failure: (frameobj == NULL) == (*mTypeMap == JSVAL_TYPE_NULL), at ../jstracer.cpp:3174

The patch in bug 632901 does not fix this; does not assert without -m.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Stack trace

Comment 2

[Jan de Mooij [:jandem]]

Also asserts with -j -m at revision bf89669b34cb, before bug 631951 landed. So this is not a regression from bug 631951.

Comment 3

[Jan de Mooij [:jandem]]

The first bad revision is:
changeset:   55725:339457364540
user:        Bill McCloskey <[e-mail]>
date:        Thu Oct 21 09:36:39 2010 -0700
summary:     Bug 580468 - Use loop profiling to decide whether to use TM or JM (second try) (r=dmandelin)

This may be a red herring though.

Comment 4

[Jan de Mooij [:jandem]]

FWIW:

(gdb) p frameobj
$1 = (JSObject *) 0x0
(gdb) p *mTypeMap
$2 = JSVAL_TYPE_NONFUNOBJ

Comment 5

[Nicholas Nethercote [inactive]]

(In reply to comment #3)
> The first bad revision is:
> changeset:   55725:339457364540
> user:        Bill McCloskey <[e-mail]>
> date:        Thu Oct 21 09:36:39 2010 -0700
> summary:     Bug 580468 - Use loop profiling to decide whether to use TM or JM
> (second try) (r=dmandelin)
> 
> This may be a red herring though.

Yeah, sounds like that changed exposed a latent bug.

Comment 6

[Jan de Mooij [:jandem]]

OK, this *does* assert without -m (see bug 633929)

Comment 7

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

I thought NULL was a legal value for JSVAL_TYPE_NONFUNOBJ? -ing on that assumption (meaning incorrect assertion).

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

It's not, but it shouldn't block anyway. Looks like Another Arguments Bug, should be easy to fix.

Comment 9

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

We're missing a deep bail by caching the result of a non-default getter. Low-risk patch.

Comment 10

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/34c05b9c0079

Comment 11

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/34c05b9c0079