1057625 - Assertion failure: static_cast<gc::Cell*>(val.toGCThing())->isTenured(), at jit/shared/Assembler-x86-shared.h:151

Status: RESOLVED DUPLICATE of bug 1023158

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision cd2acc7ab2f8 (run with --no-threads --fuzzing-safe --ion-eager):


function c() {
    this.x = 3;
}
Object.prototype.__defineSetter__('x', (function() {
    "use asm"
    function prototype(){}
    return prototype;
}))
new c;

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Marking s-s because this is a GC-related assertion. Needinfo from luke since it includes ASM.js.

Comment 3

[Luke Wagner [:luke]]

I think this is another instance of the isTenured() assert we saw in the other bug (I don't have the bug # handy).  As with that bug, I think asm.js is just tickling the bug by putting a native in a place there are usually only interpreted functions.  I assume it's the same type of fix.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/36814bee6277
user:        Brian Hackett
date:        Mon Aug 11 08:40:26 2014 -0800
summary:     Bug 1023158 - Add writeDataRelocation() call, r=jandem.

This iteration took 368.731 seconds to run.

Comment 5

[Christian Holler (:decoder)]

Needinfo from Brian based on comment 4 :)

Comment 6

[Brian Hackett [Laid off!]]

That patch didn't cause this bug, it just exposed an underlying issue which we weren't asserting before.