Assertion failure: !obj->isIndexed(), at jit/VMFunctions.cpp:1116

RESOLVED FIXED in mozilla37

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla37
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox34 affected, firefox35 affected, firefox36 affected, firefox37 affected, firefox-esr31 affected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

3 years ago
The following testcase asserts on mozilla-central revision d697d649c765 (run with --no-threads --fuzzing-safe --ion-eager):


function foo() {
  var obj = new Object();
  var index = [ -0, 2147483648, 1073741825 ];
  for (var j in index) { 
    testProperty(index[j]); 
  }
  function testProperty(i) {
    obj[i] = '' + i;
  }
} foo();
(Reporter)

Comment 1

3 years ago
Created attachment 8481328 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

3 years ago
status-firefox34: --- → affected
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Comment 2

3 years ago
This isn't bisecting because the earliest changeset autobisect picks also crashes. This is probably because it goes further back than the --no-threads flag (before non-threadsafe removal). It still reproduces though.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7cfba1345851
user:        Jan de Mooij
date:        Wed Apr 16 17:24:23 2014 +0200
summary:     Bug 997081 - Optimize StoreElementHole OOL VM call. r=bhackett

Jan, is bug 997081 a likely regressor?
Blocks: 997081
Flags: needinfo?(jdemooij)
status-firefox35: --- → affected
status-firefox36: --- → affected
status-firefox37: --- → affected
status-firefox-esr31: --- → affected
Keywords: regression
OS: Linux → All
Hardware: x86 → All
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Assignee)

Comment 4

3 years ago
Created attachment 8542121 [details] [diff] [review]
Patch

I think this is just a bogus assert. We call ensureDenseElements -> ensureDenseElementsNoPackedCheck -> extendDenseElements and there we check isIndexed() and if true return ED_SPARSE.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8542121 - Flags: review?(bhackett1024)
Attachment #8542121 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 5

3 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/aac57ca292f4
https://hg.mozilla.org/mozilla-central/rev/aac57ca292f4
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
You need to log in before you can comment on or make changes to this bug.