1007512 - OdinMonkey: Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

new(function(stdlib, n, heap) {
    "use asm"
    var x = new stdlib.Uint32Array(heap)
    function f() {}
    return f
})

asserts js debug shell on m-c changeset 4c4dcf7533cb with --ion-eager --ion-parallel-compile=off at Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140430134811" and the hash "34736c996ff7".
The "bad" changeset has the timestamp "20140430142911" and the hash "a0666ad474fa".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=34736c996ff7&tochange=a0666ad474fa

Benjamin, is bug 999790 a likely regressor?

Comment 1

[Shu-yu Guo [:shu]]

No, this is most likely my fault.

We seem to be trying to monitor a magic JS_IS_CONSTRUCTING value.

Comment 2

[Shu-yu Guo [:shu]]

Attachment: Propagate construct flag correctly when failing to link asm.js module.

Turns out wasn't my fault, and happily the fix was a one liner.

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 8419218 [details] [diff] [review]
Propagate construct flag correctly when failing to link asm.js module.

Thanks!

Comment 4

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8b70092ccb11

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8b70092ccb11