1006870 - Crash [@ ArgGetter] or [@ js::Shape::get] or Assertion failure: isObject(), at dist/include/js/Value.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug and opt stacks

(function (x) {
    for (var aa = 0; aa < 1; aa++) {
        Uint16Array(arguments.callee.arguments);
    }
})(this);

asserts js debug shell on m-c changeset 4e4e0f502969 with --ion-parallel-compile=off --ion-eager at Assertion failure: isObject(), at dist/include/js/Value.h and crashes js opt shell at ArgGetter with js::Shape::get on the stack.

My configure flags are: (opt)

AR=ar sh /home/fuzz2lin/trees/mozilla-central/js/src/configure --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

Debug:

AR=ar sh /home/fuzz2lin/trees/mozilla-central/js/src/configure --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/d34458e80bcb
user:        Shu-yu Guo
date:        Thu Apr 24 01:59:36 2014 -0700
summary:     Bug 716647 - Part 1: Introduce JS_OPTIMIZED_OUT magic for optimized out slots and teach Debugger about them. (r=jandem)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This is fixed by the patch in bug 1005458.