899510 - Assertion failure: isObject(), at jsinferinlines.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

p0 = ParallelArray([889], function() {})
var x = new ArrayBuffer(8)
y = new Uint32Array(x)[0] = -3
var z = new Float32Array(x)
p0.scan(function() {
    return z[0]
})

asserts js (deterministic threadsafe 32-bit) debug shell on m-c changeset 3d40d270c031 without any CLI arguments at Assertion failure: isObject(), at jsinferinlines.h

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0670cdaf7e9c
user:        Brian Hackett
date:        Thu Jul 11 15:08:26 2013 -0600
summary:     Bug 891400 - Improve pattern matching on static typed array accesses, r=jandem.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f0ce0463bd65
user:        Brian Hackett
date:        Mon Jul 29 11:55:49 2013 -0600
summary:     Bug 897202 - Add some double canonicalization, r=luke.

Assuming fixed by bug 897202.